]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/bluetooth/hci_core.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix missing length checks for L2CAP signalling PDUs
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
1da177e4 30
8c520a59 31#include <linux/rfkill.h>
1da177e4
LT		 32
33#include <net/bluetooth/bluetooth.h>
34#include <net/bluetooth/hci_core.h>
35
b78752cc 36static void hci_rx_work(struct work_struct *work);
c347b765 37static void hci_cmd_work(struct work_struct *work);
3eff45ea 38static void hci_tx_work(struct work_struct *work);
1da177e4 39
1da177e4
LT		 40/* HCI device list */
41LIST_HEAD(hci_dev_list);
42DEFINE_RWLOCK(hci_dev_list_lock);
43
44/* HCI callback list */
45LIST_HEAD(hci_cb_list);
46DEFINE_RWLOCK(hci_cb_list_lock);
47
3df92b31
SL		 48/* HCI ID Numbering */
49static DEFINE_IDA(hci_index_ida);
50
1da177e4
LT		 51/* ---- HCI notifications ---- */
52
6516455d 53static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 54{
040030ef 55 hci_sock_dev_event(hdev, event);
1da177e4
LT		 56}
57
58/* ---- HCI requests ---- */
59
42c6b129 60static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
1da177e4 61{
42c6b129 62 BT_DBG("%s result 0x%2.2x", hdev->name, result);
1da177e4
LT		 63
64 if (hdev->req_status == HCI_REQ_PEND) {
65 hdev->req_result = result;
66 hdev->req_status = HCI_REQ_DONE;
67 wake_up_interruptible(&hdev->req_wait_q);
68 }
69}
70
71static void hci_req_cancel(struct hci_dev *hdev, int err)
72{
73 BT_DBG("%s err 0x%2.2x", hdev->name, err);
74
75 if (hdev->req_status == HCI_REQ_PEND) {
76 hdev->req_result = err;
77 hdev->req_status = HCI_REQ_CANCELED;
78 wake_up_interruptible(&hdev->req_wait_q);
79 }
80}
81
77a63e0a
FW		 82static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
83 u8 event)
75e84b7c
JH		 84{
85 struct hci_ev_cmd_complete *ev;
86 struct hci_event_hdr *hdr;
87 struct sk_buff *skb;
88
89 hci_dev_lock(hdev);
90
91 skb = hdev->recv_evt;
92 hdev->recv_evt = NULL;
93
94 hci_dev_unlock(hdev);
95
96 if (!skb)
97 return ERR_PTR(-ENODATA);
98
99 if (skb->len < sizeof(*hdr)) {
100 BT_ERR("Too short HCI event");
101 goto failed;
102 }
103
104 hdr = (void *) skb->data;
105 skb_pull(skb, HCI_EVENT_HDR_SIZE);
106
7b1abbbe
JH		 107 if (event) {
108 if (hdr->evt != event)
109 goto failed;
110 return skb;
111 }
112
75e84b7c
JH		 113 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
114 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
115 goto failed;
116 }
117
118 if (skb->len < sizeof(*ev)) {
119 BT_ERR("Too short cmd_complete event");
120 goto failed;
121 }
122
123 ev = (void *) skb->data;
124 skb_pull(skb, sizeof(*ev));
125
126 if (opcode == __le16_to_cpu(ev->opcode))
127 return skb;
128
129 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
130 __le16_to_cpu(ev->opcode));
131
132failed:
133 kfree_skb(skb);
134 return ERR_PTR(-ENODATA);
135}
136
7b1abbbe 137struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 138 const void *param, u8 event, u32 timeout)
75e84b7c
JH		 139{
140 DECLARE_WAITQUEUE(wait, current);
141 struct hci_request req;
142 int err = 0;
143
144 BT_DBG("%s", hdev->name);
145
146 hci_req_init(&req, hdev);
147
7b1abbbe 148 hci_req_add_ev(&req, opcode, plen, param, event);
75e84b7c
JH		 149
150 hdev->req_status = HCI_REQ_PEND;
151
152 err = hci_req_run(&req, hci_req_sync_complete);
153 if (err < 0)
154 return ERR_PTR(err);
155
156 add_wait_queue(&hdev->req_wait_q, &wait);
157 set_current_state(TASK_INTERRUPTIBLE);
158
159 schedule_timeout(timeout);
160
161 remove_wait_queue(&hdev->req_wait_q, &wait);
162
163 if (signal_pending(current))
164 return ERR_PTR(-EINTR);
165
166 switch (hdev->req_status) {
167 case HCI_REQ_DONE:
168 err = -bt_to_errno(hdev->req_result);
169 break;
170
171 case HCI_REQ_CANCELED:
172 err = -hdev->req_result;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 break;
178 }
179
180 hdev->req_status = hdev->req_result = 0;
181
182 BT_DBG("%s end: err %d", hdev->name, err);
183
184 if (err < 0)
185 return ERR_PTR(err);
186
7b1abbbe
JH		 187 return hci_get_cmd_complete(hdev, opcode, event);
188}
189EXPORT_SYMBOL(__hci_cmd_sync_ev);
190
191struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 192 const void *param, u32 timeout)
7b1abbbe
JH		 193{
194 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
75e84b7c
JH		 195}
196EXPORT_SYMBOL(__hci_cmd_sync);
197
1da177e4 198/* Execute request and wait for completion. */
01178cd4 199static int __hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 200 void (*func)(struct hci_request *req,
201 unsigned long opt),
01178cd4 202 unsigned long opt, __u32 timeout)
1da177e4 203{
42c6b129 204 struct hci_request req;
1da177e4
LT		 205 DECLARE_WAITQUEUE(wait, current);
206 int err = 0;
207
208 BT_DBG("%s start", hdev->name);
209
42c6b129
JH		 210 hci_req_init(&req, hdev);
211
1da177e4
LT		 212 hdev->req_status = HCI_REQ_PEND;
213
42c6b129 214 func(&req, opt);
53cce22d 215
42c6b129
JH		 216 err = hci_req_run(&req, hci_req_sync_complete);
217 if (err < 0) {
53cce22d 218 hdev->req_status = 0;
920c8300
AG		 219
220 /* ENODATA means the HCI request command queue is empty.
221 * This can happen when a request with conditionals doesn't
222 * trigger any commands to be sent. This is normal behavior
223 * and should not trigger an error return.
42c6b129 224 */
920c8300
AG		 225 if (err == -ENODATA)
226 return 0;
227
228 return err;
53cce22d
JH		 229 }
230
bc4445c7
AG		 231 add_wait_queue(&hdev->req_wait_q, &wait);
232 set_current_state(TASK_INTERRUPTIBLE);
233
1da177e4
LT		 234 schedule_timeout(timeout);
235
236 remove_wait_queue(&hdev->req_wait_q, &wait);
237
238 if (signal_pending(current))
239 return -EINTR;
240
241 switch (hdev->req_status) {
242 case HCI_REQ_DONE:
e175072f 243 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 244 break;
245
246 case HCI_REQ_CANCELED:
247 err = -hdev->req_result;
248 break;
249
250 default:
251 err = -ETIMEDOUT;
252 break;
3ff50b79 253 }
1da177e4 254
a5040efa 255 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 256
257 BT_DBG("%s end: err %d", hdev->name, err);
258
259 return err;
260}
261
01178cd4 262static int hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 263 void (*req)(struct hci_request *req,
264 unsigned long opt),
01178cd4 265 unsigned long opt, __u32 timeout)
1da177e4
LT		 266{
267 int ret;
268
7c6a329e
MH		 269 if (!test_bit(HCI_UP, &hdev->flags))
270 return -ENETDOWN;
271
1da177e4
LT		 272 /* Serialize all requests */
273 hci_req_lock(hdev);
01178cd4 274 ret = __hci_req_sync(hdev, req, opt, timeout);
1da177e4
LT		 275 hci_req_unlock(hdev);
276
277 return ret;
278}
279
42c6b129 280static void hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 281{
42c6b129 282 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 283
284 /* Reset device */
42c6b129
JH		 285 set_bit(HCI_RESET, &req->hdev->flags);
286 hci_req_add(req, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 287}
288
42c6b129 289static void bredr_init(struct hci_request *req)
1da177e4 290{
42c6b129 291 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 292
1da177e4 293 /* Read Local Supported Features */
42c6b129 294 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 295
1143e5a6 296 /* Read Local Version */
42c6b129 297 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 298
299 /* Read BD Address */
42c6b129 300 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 301}
302
42c6b129 303static void amp_init(struct hci_request *req)
e61ef499 304{
42c6b129 305 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 306
e61ef499 307 /* Read Local Version */
42c6b129 308 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489
AE		 309
310 /* Read Local AMP Info */
42c6b129 311 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 312
313 /* Read Data Blk size */
42c6b129 314 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
e61ef499
AE		 315}
316
42c6b129 317static void hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 318{
42c6b129 319 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 320
321 BT_DBG("%s %ld", hdev->name, opt);
322
11778716
AE		 323 /* Reset */
324 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 325 hci_reset_req(req, 0);
11778716 326
e61ef499
AE		 327 switch (hdev->dev_type) {
328 case HCI_BREDR:
42c6b129 329 bredr_init(req);
e61ef499
AE		 330 break;
331
332 case HCI_AMP:
42c6b129 333 amp_init(req);
e61ef499
AE		 334 break;
335
336 default:
337 BT_ERR("Unknown device type %d", hdev->dev_type);
338 break;
339 }
e61ef499
AE		 340}
341
42c6b129 342static void bredr_setup(struct hci_request *req)
2177bab5
JH		 343{
344 struct hci_cp_delete_stored_link_key cp;
345 __le16 param;
346 __u8 flt_type;
347
348 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 349 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 350
351 /* Read Class of Device */
42c6b129 352 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 353
354 /* Read Local Name */
42c6b129 355 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 356
357 /* Read Voice Setting */
42c6b129 358 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5
JH		 359
360 /* Clear Event Filters */
361 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 362 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 363
364 /* Connection accept timeout ~20 secs */
365 param = __constant_cpu_to_le16(0x7d00);
42c6b129 366 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5
JH		 367
368 bacpy(&cp.bdaddr, BDADDR_ANY);
369 cp.delete_all = 0x01;
42c6b129 370 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
f332ec66
JH		 371
372 /* Read page scan parameters */
373 if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
374 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
375 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
376 }
2177bab5
JH		 377}
378
42c6b129 379static void le_setup(struct hci_request *req)
2177bab5 380{
c73eee91
JH		 381 struct hci_dev *hdev = req->hdev;
382
2177bab5 383 /* Read LE Buffer Size */
42c6b129 384 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 385
386 /* Read LE Local Supported Features */
42c6b129 387 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5
JH		 388
389 /* Read LE Advertising Channel TX Power */
42c6b129 390 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
2177bab5
JH		 391
392 /* Read LE White List Size */
42c6b129 393 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
2177bab5
JH		 394
395 /* Read LE Supported States */
42c6b129 396 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
c73eee91
JH		 397
398 /* LE-only controllers have LE implicitly enabled */
399 if (!lmp_bredr_capable(hdev))
400 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2177bab5
JH		 401}
402
403static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
404{
405 if (lmp_ext_inq_capable(hdev))
406 return 0x02;
407
408 if (lmp_inq_rssi_capable(hdev))
409 return 0x01;
410
411 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
412 hdev->lmp_subver == 0x0757)
413 return 0x01;
414
415 if (hdev->manufacturer == 15) {
416 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
417 return 0x01;
418 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
419 return 0x01;
420 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
421 return 0x01;
422 }
423
424 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
425 hdev->lmp_subver == 0x1805)
426 return 0x01;
427
428 return 0x00;
429}
430
42c6b129 431static void hci_setup_inquiry_mode(struct hci_request *req)
2177bab5
JH		 432{
433 u8 mode;
434
42c6b129 435 mode = hci_get_inquiry_mode(req->hdev);
2177bab5 436
42c6b129 437 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
2177bab5
JH		 438}
439
42c6b129 440static void hci_setup_event_mask(struct hci_request *req)
2177bab5 441{
42c6b129
JH		 442 struct hci_dev *hdev = req->hdev;
443
2177bab5
JH		 444 /* The second byte is 0xff instead of 0x9f (two reserved bits
445 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
446 * command otherwise.
447 */
448 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
449
450 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
451 * any event mask for pre 1.2 devices.
452 */
453 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
454 return;
455
456 if (lmp_bredr_capable(hdev)) {
457 events[4] |= 0x01; /* Flow Specification Complete */
458 events[4] |= 0x02; /* Inquiry Result with RSSI */
459 events[4] |= 0x04; /* Read Remote Extended Features Complete */
460 events[5] |= 0x08; /* Synchronous Connection Complete */
461 events[5] |= 0x10; /* Synchronous Connection Changed */
462 }
463
464 if (lmp_inq_rssi_capable(hdev))
465 events[4] |= 0x02; /* Inquiry Result with RSSI */
466
467 if (lmp_sniffsubr_capable(hdev))
468 events[5] |= 0x20; /* Sniff Subrating */
469
470 if (lmp_pause_enc_capable(hdev))
471 events[5] |= 0x80; /* Encryption Key Refresh Complete */
472
473 if (lmp_ext_inq_capable(hdev))
474 events[5] |= 0x40; /* Extended Inquiry Result */
475
476 if (lmp_no_flush_capable(hdev))
477 events[7] |= 0x01; /* Enhanced Flush Complete */
478
479 if (lmp_lsto_capable(hdev))
480 events[6] |= 0x80; /* Link Supervision Timeout Changed */
481
482 if (lmp_ssp_capable(hdev)) {
483 events[6] |= 0x01; /* IO Capability Request */
484 events[6] |= 0x02; /* IO Capability Response */
485 events[6] |= 0x04; /* User Confirmation Request */
486 events[6] |= 0x08; /* User Passkey Request */
487 events[6] |= 0x10; /* Remote OOB Data Request */
488 events[6] |= 0x20; /* Simple Pairing Complete */
489 events[7] |= 0x04; /* User Passkey Notification */
490 events[7] |= 0x08; /* Keypress Notification */
491 events[7] |= 0x10; /* Remote Host Supported
492 * Features Notification
493 */
494 }
495
496 if (lmp_le_capable(hdev))
497 events[7] |= 0x20; /* LE Meta-Event */
498
42c6b129 499 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 500
501 if (lmp_le_capable(hdev)) {
502 memset(events, 0, sizeof(events));
503 events[0] = 0x1f;
42c6b129
JH		 504 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
505 sizeof(events), events);
2177bab5
JH		 506 }
507}
508
42c6b129 509static void hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 510{
42c6b129
JH		 511 struct hci_dev *hdev = req->hdev;
512
2177bab5 513 if (lmp_bredr_capable(hdev))
42c6b129 514 bredr_setup(req);
2177bab5
JH		 515
516 if (lmp_le_capable(hdev))
42c6b129 517 le_setup(req);
2177bab5 518
42c6b129 519 hci_setup_event_mask(req);
2177bab5
JH		 520
521 if (hdev->hci_ver > BLUETOOTH_VER_1_1)
42c6b129 522 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 523
524 if (lmp_ssp_capable(hdev)) {
525 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
526 u8 mode = 0x01;
42c6b129
JH		 527 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
528 sizeof(mode), &mode);
2177bab5
JH		 529 } else {
530 struct hci_cp_write_eir cp;
531
532 memset(hdev->eir, 0, sizeof(hdev->eir));
533 memset(&cp, 0, sizeof(cp));
534
42c6b129 535 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 536 }
537 }
538
539 if (lmp_inq_rssi_capable(hdev))
42c6b129 540 hci_setup_inquiry_mode(req);
2177bab5
JH		 541
542 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 543 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 544
545 if (lmp_ext_feat_capable(hdev)) {
546 struct hci_cp_read_local_ext_features cp;
547
548 cp.page = 0x01;
42c6b129
JH		 549 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
550 sizeof(cp), &cp);
2177bab5
JH		 551 }
552
553 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
554 u8 enable = 1;
42c6b129
JH		 555 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
556 &enable);
2177bab5
JH		 557 }
558}
559
42c6b129 560static void hci_setup_link_policy(struct hci_request *req)
2177bab5 561{
42c6b129 562 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 563 struct hci_cp_write_def_link_policy cp;
564 u16 link_policy = 0;
565
566 if (lmp_rswitch_capable(hdev))
567 link_policy |= HCI_LP_RSWITCH;
568 if (lmp_hold_capable(hdev))
569 link_policy |= HCI_LP_HOLD;
570 if (lmp_sniff_capable(hdev))
571 link_policy |= HCI_LP_SNIFF;
572 if (lmp_park_capable(hdev))
573 link_policy |= HCI_LP_PARK;
574
575 cp.policy = cpu_to_le16(link_policy);
42c6b129 576 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 577}
578
42c6b129 579static void hci_set_le_support(struct hci_request *req)
2177bab5 580{
42c6b129 581 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 582 struct hci_cp_write_le_host_supported cp;
583
c73eee91
JH		 584 /* LE-only devices do not support explicit enablement */
585 if (!lmp_bredr_capable(hdev))
586 return;
587
2177bab5
JH		 588 memset(&cp, 0, sizeof(cp));
589
590 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
591 cp.le = 0x01;
592 cp.simul = lmp_le_br_capable(hdev);
593 }
594
595 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 596 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
597 &cp);
2177bab5
JH		 598}
599
42c6b129 600static void hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 601{
42c6b129 602 struct hci_dev *hdev = req->hdev;
d2c5d77f 603 u8 p;
42c6b129 604
2177bab5 605 if (hdev->commands[5] & 0x10)
42c6b129 606 hci_setup_link_policy(req);
2177bab5 607
04b4edcb 608 if (lmp_le_capable(hdev)) {
42c6b129 609 hci_set_le_support(req);
04b4edcb
JH		 610 hci_update_ad(req);
611 }
d2c5d77f
JH		 612
613 /* Read features beyond page 1 if available */
614 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
615 struct hci_cp_read_local_ext_features cp;
616
617 cp.page = p;
618 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
619 sizeof(cp), &cp);
620 }
2177bab5
JH		 621}
622
623static int __hci_init(struct hci_dev *hdev)
624{
625 int err;
626
627 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
628 if (err < 0)
629 return err;
630
631 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
632 * BR/EDR/LE type controllers. AMP controllers only need the
633 * first stage init.
634 */
635 if (hdev->dev_type != HCI_BREDR)
636 return 0;
637
638 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
639 if (err < 0)
640 return err;
641
642 return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
643}
644
42c6b129 645static void hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 646{
647 __u8 scan = opt;
648
42c6b129 649 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 650
651 /* Inquiry and Page scans */
42c6b129 652 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 653}
654
42c6b129 655static void hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 656{
657 __u8 auth = opt;
658
42c6b129 659 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 660
661 /* Authentication */
42c6b129 662 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 663}
664
42c6b129 665static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 666{
667 __u8 encrypt = opt;
668
42c6b129 669 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 670
e4e8e37c 671 /* Encryption */
42c6b129 672 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 673}
674
42c6b129 675static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 676{
677 __le16 policy = cpu_to_le16(opt);
678
42c6b129 679 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 680
681 /* Default link policy */
42c6b129 682 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
e4e8e37c
MH		 683}
684
8e87d142 685/* Get HCI device by index.
1da177e4
LT		 686 * Device is held on return. */
687struct hci_dev *hci_dev_get(int index)
688{
8035ded4 689 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 690
691 BT_DBG("%d", index);
692
693 if (index < 0)
694 return NULL;
695
696 read_lock(&hci_dev_list_lock);
8035ded4 697 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 698 if (d->id == index) {
699 hdev = hci_dev_hold(d);
700 break;
701 }
702 }
703 read_unlock(&hci_dev_list_lock);
704 return hdev;
705}
1da177e4
LT		 706
707/* ---- Inquiry support ---- */
ff9ef578 708
30dc78e1
JH		 709bool hci_discovery_active(struct hci_dev *hdev)
710{
711 struct discovery_state *discov = &hdev->discovery;
712
6fbe195d 713 switch (discov->state) {
343f935b 714 case DISCOVERY_FINDING:
6fbe195d 715 case DISCOVERY_RESOLVING:
30dc78e1
JH		 716 return true;
717
6fbe195d
AG		 718 default:
719 return false;
720 }
30dc78e1
JH		 721}
722
ff9ef578
JH		 723void hci_discovery_set_state(struct hci_dev *hdev, int state)
724{
725 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
726
727 if (hdev->discovery.state == state)
728 return;
729
730 switch (state) {
731 case DISCOVERY_STOPPED:
7b99b659
AG		 732 if (hdev->discovery.state != DISCOVERY_STARTING)
733 mgmt_discovering(hdev, 0);
ff9ef578
JH		 734 break;
735 case DISCOVERY_STARTING:
736 break;
343f935b 737 case DISCOVERY_FINDING:
ff9ef578
JH		 738 mgmt_discovering(hdev, 1);
739 break;
30dc78e1
JH		 740 case DISCOVERY_RESOLVING:
741 break;
ff9ef578
JH		 742 case DISCOVERY_STOPPING:
743 break;
744 }
745
746 hdev->discovery.state = state;
747}
748
1da177e4
LT		 749static void inquiry_cache_flush(struct hci_dev *hdev)
750{
30883512 751 struct discovery_state *cache = &hdev->discovery;
b57c1a56 752 struct inquiry_entry *p, *n;
1da177e4 753
561aafbc
JH		 754 list_for_each_entry_safe(p, n, &cache->all, all) {
755 list_del(&p->all);
b57c1a56 756 kfree(p);
1da177e4 757 }
561aafbc
JH		 758
759 INIT_LIST_HEAD(&cache->unknown);
760 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 761}
762
a8c5fb1a
GP		 763struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
764 bdaddr_t *bdaddr)
1da177e4 765{
30883512 766 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 767 struct inquiry_entry *e;
768
6ed93dc6 769 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 770
561aafbc
JH		 771 list_for_each_entry(e, &cache->all, all) {
772 if (!bacmp(&e->data.bdaddr, bdaddr))
773 return e;
774 }
775
776 return NULL;
777}
778
779struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 780 bdaddr_t *bdaddr)
561aafbc 781{
30883512 782 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 783 struct inquiry_entry *e;
784
6ed93dc6 785 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 786
787 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 788 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 789 return e;
790 }
791
792 return NULL;
1da177e4
LT		 793}
794
30dc78e1 795struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 796 bdaddr_t *bdaddr,
797 int state)
30dc78e1
JH		 798{
799 struct discovery_state *cache = &hdev->discovery;
800 struct inquiry_entry *e;
801
6ed93dc6 802 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 803
804 list_for_each_entry(e, &cache->resolve, list) {
805 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
806 return e;
807 if (!bacmp(&e->data.bdaddr, bdaddr))
808 return e;
809 }
810
811 return NULL;
812}
813
a3d4e20a 814void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 815 struct inquiry_entry *ie)
a3d4e20a
JH		 816{
817 struct discovery_state *cache = &hdev->discovery;
818 struct list_head *pos = &cache->resolve;
819 struct inquiry_entry *p;
820
821 list_del(&ie->list);
822
823 list_for_each_entry(p, &cache->resolve, list) {
824 if (p->name_state != NAME_PENDING &&
a8c5fb1a 825 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 826 break;
827 pos = &p->list;
828 }
829
830 list_add(&ie->list, pos);
831}
832
3175405b 833bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
04124681 834 bool name_known, bool *ssp)
1da177e4 835{
30883512 836 struct discovery_state *cache = &hdev->discovery;
70f23020 837 struct inquiry_entry *ie;
1da177e4 838
6ed93dc6 839 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 840
2b2fec4d
SJ		 841 hci_remove_remote_oob_data(hdev, &data->bdaddr);
842
388fc8fa
JH		 843 if (ssp)
844 *ssp = data->ssp_mode;
845
70f23020 846 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 847 if (ie) {
388fc8fa
JH		 848 if (ie->data.ssp_mode && ssp)
849 *ssp = true;
850
a3d4e20a 851 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 852 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 853 ie->data.rssi = data->rssi;
854 hci_inquiry_cache_update_resolve(hdev, ie);
855 }
856
561aafbc 857 goto update;
a3d4e20a 858 }
561aafbc
JH		 859
860 /* Entry not in the cache. Add new one. */
861 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
862 if (!ie)
3175405b 863 return false;
561aafbc
JH		 864
865 list_add(&ie->all, &cache->all);
866
867 if (name_known) {
868 ie->name_state = NAME_KNOWN;
869 } else {
870 ie->name_state = NAME_NOT_KNOWN;
871 list_add(&ie->list, &cache->unknown);
872 }
70f23020 873
561aafbc
JH		 874update:
875 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 876 ie->name_state != NAME_PENDING) {
561aafbc
JH		 877 ie->name_state = NAME_KNOWN;
878 list_del(&ie->list);
1da177e4
LT		 879 }
880
70f23020
AE		 881 memcpy(&ie->data, data, sizeof(*data));
882 ie->timestamp = jiffies;
1da177e4 883 cache->timestamp = jiffies;
3175405b
JH		 884
885 if (ie->name_state == NAME_NOT_KNOWN)
886 return false;
887
888 return true;
1da177e4
LT		 889}
890
891static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
892{
30883512 893 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 894 struct inquiry_info *info = (struct inquiry_info *) buf;
895 struct inquiry_entry *e;
896 int copied = 0;
897
561aafbc 898 list_for_each_entry(e, &cache->all, all) {
1da177e4 899 struct inquiry_data *data = &e->data;
b57c1a56
JH		 900
901 if (copied >= num)
902 break;
903
1da177e4
LT		 904 bacpy(&info->bdaddr, &data->bdaddr);
905 info->pscan_rep_mode = data->pscan_rep_mode;
906 info->pscan_period_mode = data->pscan_period_mode;
907 info->pscan_mode = data->pscan_mode;
908 memcpy(info->dev_class, data->dev_class, 3);
909 info->clock_offset = data->clock_offset;
b57c1a56 910
1da177e4 911 info++;
b57c1a56 912 copied++;
1da177e4
LT		 913 }
914
915 BT_DBG("cache %p, copied %d", cache, copied);
916 return copied;
917}
918
42c6b129 919static void hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 920{
921 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 922 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 923 struct hci_cp_inquiry cp;
924
925 BT_DBG("%s", hdev->name);
926
927 if (test_bit(HCI_INQUIRY, &hdev->flags))
928 return;
929
930 /* Start Inquiry */
931 memcpy(&cp.lap, &ir->lap, 3);
932 cp.length = ir->length;
933 cp.num_rsp = ir->num_rsp;
42c6b129 934 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 935}
936
3e13fa1e
AG		 937static int wait_inquiry(void *word)
938{
939 schedule();
940 return signal_pending(current);
941}
942
1da177e4
LT		 943int hci_inquiry(void __user *arg)
944{
945 __u8 __user *ptr = arg;
946 struct hci_inquiry_req ir;
947 struct hci_dev *hdev;
948 int err = 0, do_inquiry = 0, max_rsp;
949 long timeo;
950 __u8 *buf;
951
952 if (copy_from_user(&ir, ptr, sizeof(ir)))
953 return -EFAULT;
954
5a08ecce
AE		 955 hdev = hci_dev_get(ir.dev_id);
956 if (!hdev)
1da177e4
LT		 957 return -ENODEV;
958
09fd0de5 959 hci_dev_lock(hdev);
8e87d142 960 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 961 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 962 inquiry_cache_flush(hdev);
963 do_inquiry = 1;
964 }
09fd0de5 965 hci_dev_unlock(hdev);
1da177e4 966
04837f64 967 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 968
969 if (do_inquiry) {
01178cd4
JH		 970 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
971 timeo);
70f23020
AE		 972 if (err < 0)
973 goto done;
3e13fa1e
AG		 974
975 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
976 * cleared). If it is interrupted by a signal, return -EINTR.
977 */
978 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
979 TASK_INTERRUPTIBLE))
980 return -EINTR;
70f23020 981 }
1da177e4 982
8fc9ced3
GP		 983 /* for unlimited number of responses we will use buffer with
984 * 255 entries
985 */
1da177e4
LT		 986 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
987
988 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
989 * copy it to the user space.
990 */
01df8c31 991 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 992 if (!buf) {
1da177e4
LT		 993 err = -ENOMEM;
994 goto done;
995 }
996
09fd0de5 997 hci_dev_lock(hdev);
1da177e4 998 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 999 hci_dev_unlock(hdev);
1da177e4
LT		 1000
1001 BT_DBG("num_rsp %d", ir.num_rsp);
1002
1003 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1004 ptr += sizeof(ir);
1005 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1006 ir.num_rsp))
1da177e4 1007 err = -EFAULT;
8e87d142 1008 } else
1da177e4
LT		 1009 err = -EFAULT;
1010
1011 kfree(buf);
1012
1013done:
1014 hci_dev_put(hdev);
1015 return err;
1016}
1017
3f0f524b
JH		 1018static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
1019{
1020 u8 ad_len = 0, flags = 0;
1021 size_t name_len;
1022
1023 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1024 flags |= LE_AD_GENERAL;
1025
1026 if (!lmp_bredr_capable(hdev))
1027 flags |= LE_AD_NO_BREDR;
1028
1029 if (lmp_le_br_capable(hdev))
1030 flags |= LE_AD_SIM_LE_BREDR_CTRL;
1031
1032 if (lmp_host_le_br_capable(hdev))
1033 flags |= LE_AD_SIM_LE_BREDR_HOST;
1034
1035 if (flags) {
1036 BT_DBG("adv flags 0x%02x", flags);
1037
1038 ptr[0] = 2;
1039 ptr[1] = EIR_FLAGS;
1040 ptr[2] = flags;
1041
1042 ad_len += 3;
1043 ptr += 3;
1044 }
1045
1046 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
1047 ptr[0] = 2;
1048 ptr[1] = EIR_TX_POWER;
1049 ptr[2] = (u8) hdev->adv_tx_power;
1050
1051 ad_len += 3;
1052 ptr += 3;
1053 }
1054
1055 name_len = strlen(hdev->dev_name);
1056 if (name_len > 0) {
1057 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
1058
1059 if (name_len > max_len) {
1060 name_len = max_len;
1061 ptr[1] = EIR_NAME_SHORT;
1062 } else
1063 ptr[1] = EIR_NAME_COMPLETE;
1064
1065 ptr[0] = name_len + 1;
1066
1067 memcpy(ptr + 2, hdev->dev_name, name_len);
1068
1069 ad_len += (name_len + 2);
1070 ptr += (name_len + 2);
1071 }
1072
1073 return ad_len;
1074}
1075
04b4edcb 1076void hci_update_ad(struct hci_request *req)
3f0f524b 1077{
04b4edcb 1078 struct hci_dev *hdev = req->hdev;
3f0f524b
JH		 1079 struct hci_cp_le_set_adv_data cp;
1080 u8 len;
3f0f524b 1081
04b4edcb
JH		 1082 if (!lmp_le_capable(hdev))
1083 return;
3f0f524b
JH		 1084
1085 memset(&cp, 0, sizeof(cp));
1086
1087 len = create_ad(hdev, cp.data);
1088
1089 if (hdev->adv_data_len == len &&
04b4edcb
JH		 1090 memcmp(cp.data, hdev->adv_data, len) == 0)
1091 return;
3f0f524b
JH		 1092
1093 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1094 hdev->adv_data_len = len;
1095
1096 cp.length = len;
3f0f524b 1097
04b4edcb 1098 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
3f0f524b
JH		 1099}
1100
1da177e4
LT		 1101/* ---- HCI ioctl helpers ---- */
1102
1103int hci_dev_open(__u16 dev)
1104{
1105 struct hci_dev *hdev;
1106 int ret = 0;
1107
5a08ecce
AE		 1108 hdev = hci_dev_get(dev);
1109 if (!hdev)
1da177e4
LT		 1110 return -ENODEV;
1111
1112 BT_DBG("%s %p", hdev->name, hdev);
1113
1114 hci_req_lock(hdev);
1115
94324962
JH		 1116 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1117 ret = -ENODEV;
1118 goto done;
1119 }
1120
611b30f7
MH		 1121 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
1122 ret = -ERFKILL;
1123 goto done;
1124 }
1125
1da177e4
LT		 1126 if (test_bit(HCI_UP, &hdev->flags)) {
1127 ret = -EALREADY;
1128 goto done;
1129 }
1130
1da177e4
LT		 1131 if (hdev->open(hdev)) {
1132 ret = -EIO;
1133 goto done;
1134 }
1135
f41c70c4
MH		 1136 atomic_set(&hdev->cmd_cnt, 1);
1137 set_bit(HCI_INIT, &hdev->flags);
1138
1139 if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1140 ret = hdev->setup(hdev);
1141
1142 if (!ret) {
1143 /* Treat all non BR/EDR controllers as raw devices if
1144 * enable_hs is not set.
1145 */
1146 if (hdev->dev_type != HCI_BREDR && !enable_hs)
1147 set_bit(HCI_RAW, &hdev->flags);
1148
1149 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1150 set_bit(HCI_RAW, &hdev->flags);
1151
1152 if (!test_bit(HCI_RAW, &hdev->flags))
1153 ret = __hci_init(hdev);
1da177e4
LT		 1154 }
1155
f41c70c4
MH		 1156 clear_bit(HCI_INIT, &hdev->flags);
1157
1da177e4
LT		 1158 if (!ret) {
1159 hci_dev_hold(hdev);
1160 set_bit(HCI_UP, &hdev->flags);
1161 hci_notify(hdev, HCI_DEV_UP);
bb4b2a9a
AE		 1162 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1163 mgmt_valid_hdev(hdev)) {
09fd0de5 1164 hci_dev_lock(hdev);
744cf19e 1165 mgmt_powered(hdev, 1);
09fd0de5 1166 hci_dev_unlock(hdev);
56e5cb86 1167 }
8e87d142 1168 } else {
1da177e4 1169 /* Init failed, cleanup */
3eff45ea 1170 flush_work(&hdev->tx_work);
c347b765 1171 flush_work(&hdev->cmd_work);
b78752cc 1172 flush_work(&hdev->rx_work);
1da177e4
LT		 1173
1174 skb_queue_purge(&hdev->cmd_q);
1175 skb_queue_purge(&hdev->rx_q);
1176
1177 if (hdev->flush)
1178 hdev->flush(hdev);
1179
1180 if (hdev->sent_cmd) {
1181 kfree_skb(hdev->sent_cmd);
1182 hdev->sent_cmd = NULL;
1183 }
1184
1185 hdev->close(hdev);
1186 hdev->flags = 0;
1187 }
1188
1189done:
1190 hci_req_unlock(hdev);
1191 hci_dev_put(hdev);
1192 return ret;
1193}
1194
1195static int hci_dev_do_close(struct hci_dev *hdev)
1196{
1197 BT_DBG("%s %p", hdev->name, hdev);
1198
28b75a89
AG		 1199 cancel_work_sync(&hdev->le_scan);
1200
78c04c0b
VCG		 1201 cancel_delayed_work(&hdev->power_off);
1202
1da177e4
LT		 1203 hci_req_cancel(hdev, ENODEV);
1204 hci_req_lock(hdev);
1205
1206 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 1207 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1208 hci_req_unlock(hdev);
1209 return 0;
1210 }
1211
3eff45ea
GP		 1212 /* Flush RX and TX works */
1213 flush_work(&hdev->tx_work);
b78752cc 1214 flush_work(&hdev->rx_work);
1da177e4 1215
16ab91ab 1216 if (hdev->discov_timeout > 0) {
e0f9309f 1217 cancel_delayed_work(&hdev->discov_off);
16ab91ab 1218 hdev->discov_timeout = 0;
5e5282bb 1219 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 1220 }
1221
a8b2d5c2 1222 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1223 cancel_delayed_work(&hdev->service_cache);
1224
7ba8b4be
AG		 1225 cancel_delayed_work_sync(&hdev->le_scan_disable);
1226
09fd0de5 1227 hci_dev_lock(hdev);
1da177e4
LT		 1228 inquiry_cache_flush(hdev);
1229 hci_conn_hash_flush(hdev);
09fd0de5 1230 hci_dev_unlock(hdev);
1da177e4
LT		 1231
1232 hci_notify(hdev, HCI_DEV_DOWN);
1233
1234 if (hdev->flush)
1235 hdev->flush(hdev);
1236
1237 /* Reset device */
1238 skb_queue_purge(&hdev->cmd_q);
1239 atomic_set(&hdev->cmd_cnt, 1);
8af59467 1240 if (!test_bit(HCI_RAW, &hdev->flags) &&
a6c511c6 1241 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 1242 set_bit(HCI_INIT, &hdev->flags);
01178cd4 1243 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 1244 clear_bit(HCI_INIT, &hdev->flags);
1245 }
1246
c347b765
GP		 1247 /* flush cmd work */
1248 flush_work(&hdev->cmd_work);
1da177e4
LT		 1249
1250 /* Drop queues */
1251 skb_queue_purge(&hdev->rx_q);
1252 skb_queue_purge(&hdev->cmd_q);
1253 skb_queue_purge(&hdev->raw_q);
1254
1255 /* Drop last sent command */
1256 if (hdev->sent_cmd) {
b79f44c1 1257 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1258 kfree_skb(hdev->sent_cmd);
1259 hdev->sent_cmd = NULL;
1260 }
1261
b6ddb638
JH		 1262 kfree_skb(hdev->recv_evt);
1263 hdev->recv_evt = NULL;
1264
1da177e4
LT		 1265 /* After this point our queues are empty
1266 * and no tasks are scheduled. */
1267 hdev->close(hdev);
1268
35b973c9
JH		 1269 /* Clear flags */
1270 hdev->flags = 0;
1271 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1272
bb4b2a9a
AE		 1273 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1274 mgmt_valid_hdev(hdev)) {
8ee56540
MH		 1275 hci_dev_lock(hdev);
1276 mgmt_powered(hdev, 0);
1277 hci_dev_unlock(hdev);
1278 }
5add6af8 1279
ced5c338
AE		 1280 /* Controller radio is available but is currently powered down */
1281 hdev->amp_status = 0;
1282
e59fda8d 1283 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1284 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
e59fda8d 1285
1da177e4
LT		 1286 hci_req_unlock(hdev);
1287
1288 hci_dev_put(hdev);
1289 return 0;
1290}
1291
1292int hci_dev_close(__u16 dev)
1293{
1294 struct hci_dev *hdev;
1295 int err;
1296
70f23020
AE		 1297 hdev = hci_dev_get(dev);
1298 if (!hdev)
1da177e4 1299 return -ENODEV;
8ee56540
MH		 1300
1301 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1302 cancel_delayed_work(&hdev->power_off);
1303
1da177e4 1304 err = hci_dev_do_close(hdev);
8ee56540 1305
1da177e4
LT		 1306 hci_dev_put(hdev);
1307 return err;
1308}
1309
1310int hci_dev_reset(__u16 dev)
1311{
1312 struct hci_dev *hdev;
1313 int ret = 0;
1314
70f23020
AE		 1315 hdev = hci_dev_get(dev);
1316 if (!hdev)
1da177e4
LT		 1317 return -ENODEV;
1318
1319 hci_req_lock(hdev);
1da177e4
LT		 1320
1321 if (!test_bit(HCI_UP, &hdev->flags))
1322 goto done;
1323
1324 /* Drop queues */
1325 skb_queue_purge(&hdev->rx_q);
1326 skb_queue_purge(&hdev->cmd_q);
1327
09fd0de5 1328 hci_dev_lock(hdev);
1da177e4
LT		 1329 inquiry_cache_flush(hdev);
1330 hci_conn_hash_flush(hdev);
09fd0de5 1331 hci_dev_unlock(hdev);
1da177e4
LT		 1332
1333 if (hdev->flush)
1334 hdev->flush(hdev);
1335
8e87d142 1336 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1337 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 1338
1339 if (!test_bit(HCI_RAW, &hdev->flags))
01178cd4 1340 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 1341
1342done:
1da177e4
LT		 1343 hci_req_unlock(hdev);
1344 hci_dev_put(hdev);
1345 return ret;
1346}
1347
1348int hci_dev_reset_stat(__u16 dev)
1349{
1350 struct hci_dev *hdev;
1351 int ret = 0;
1352
70f23020
AE		 1353 hdev = hci_dev_get(dev);
1354 if (!hdev)
1da177e4
LT		 1355 return -ENODEV;
1356
1357 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1358
1359 hci_dev_put(hdev);
1360
1361 return ret;
1362}
1363
1364int hci_dev_cmd(unsigned int cmd, void __user *arg)
1365{
1366 struct hci_dev *hdev;
1367 struct hci_dev_req dr;
1368 int err = 0;
1369
1370 if (copy_from_user(&dr, arg, sizeof(dr)))
1371 return -EFAULT;
1372
70f23020
AE		 1373 hdev = hci_dev_get(dr.dev_id);
1374 if (!hdev)
1da177e4
LT		 1375 return -ENODEV;
1376
1377 switch (cmd) {
1378 case HCISETAUTH:
01178cd4
JH		 1379 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1380 HCI_INIT_TIMEOUT);
1da177e4
LT		 1381 break;
1382
1383 case HCISETENCRYPT:
1384 if (!lmp_encrypt_capable(hdev)) {
1385 err = -EOPNOTSUPP;
1386 break;
1387 }
1388
1389 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1390 /* Auth must be enabled first */
01178cd4
JH		 1391 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1392 HCI_INIT_TIMEOUT);
1da177e4
LT		 1393 if (err)
1394 break;
1395 }
1396
01178cd4
JH		 1397 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1398 HCI_INIT_TIMEOUT);
1da177e4
LT		 1399 break;
1400
1401 case HCISETSCAN:
01178cd4
JH		 1402 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1403 HCI_INIT_TIMEOUT);
1da177e4
LT		 1404 break;
1405
1da177e4 1406 case HCISETLINKPOL:
01178cd4
JH		 1407 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1408 HCI_INIT_TIMEOUT);
1da177e4
LT		 1409 break;
1410
1411 case HCISETLINKMODE:
e4e8e37c
MH		 1412 hdev->link_mode = ((__u16) dr.dev_opt) &
1413 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1414 break;
1415
1416 case HCISETPTYPE:
1417 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 1418 break;
1419
1420 case HCISETACLMTU:
e4e8e37c
MH		 1421 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1422 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1423 break;
1424
1425 case HCISETSCOMTU:
e4e8e37c
MH		 1426 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1427 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1428 break;
1429
1430 default:
1431 err = -EINVAL;
1432 break;
1433 }
e4e8e37c 1434
1da177e4
LT		 1435 hci_dev_put(hdev);
1436 return err;
1437}
1438
1439int hci_get_dev_list(void __user *arg)
1440{
8035ded4 1441 struct hci_dev *hdev;
1da177e4
LT		 1442 struct hci_dev_list_req *dl;
1443 struct hci_dev_req *dr;
1da177e4
LT		 1444 int n = 0, size, err;
1445 __u16 dev_num;
1446
1447 if (get_user(dev_num, (__u16 __user *) arg))
1448 return -EFAULT;
1449
1450 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1451 return -EINVAL;
1452
1453 size = sizeof(*dl) + dev_num * sizeof(*dr);
1454
70f23020
AE		 1455 dl = kzalloc(size, GFP_KERNEL);
1456 if (!dl)
1da177e4
LT		 1457 return -ENOMEM;
1458
1459 dr = dl->dev_req;
1460
f20d09d5 1461 read_lock(&hci_dev_list_lock);
8035ded4 1462 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 1463 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 1464 cancel_delayed_work(&hdev->power_off);
c542a06c 1465
a8b2d5c2
JH		 1466 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1467 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1468
1da177e4
LT		 1469 (dr + n)->dev_id = hdev->id;
1470 (dr + n)->dev_opt = hdev->flags;
c542a06c 1471
1da177e4
LT		 1472 if (++n >= dev_num)
1473 break;
1474 }
f20d09d5 1475 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1476
1477 dl->dev_num = n;
1478 size = sizeof(*dl) + n * sizeof(*dr);
1479
1480 err = copy_to_user(arg, dl, size);
1481 kfree(dl);
1482
1483 return err ? -EFAULT : 0;
1484}
1485
1486int hci_get_dev_info(void __user *arg)
1487{
1488 struct hci_dev *hdev;
1489 struct hci_dev_info di;
1490 int err = 0;
1491
1492 if (copy_from_user(&di, arg, sizeof(di)))
1493 return -EFAULT;
1494
70f23020
AE		 1495 hdev = hci_dev_get(di.dev_id);
1496 if (!hdev)
1da177e4
LT		 1497 return -ENODEV;
1498
a8b2d5c2 1499 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 1500 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 1501
a8b2d5c2
JH		 1502 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1503 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1504
1da177e4
LT		 1505 strcpy(di.name, hdev->name);
1506 di.bdaddr = hdev->bdaddr;
943da25d 1507 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 1508 di.flags = hdev->flags;
1509 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1510 if (lmp_bredr_capable(hdev)) {
1511 di.acl_mtu = hdev->acl_mtu;
1512 di.acl_pkts = hdev->acl_pkts;
1513 di.sco_mtu = hdev->sco_mtu;
1514 di.sco_pkts = hdev->sco_pkts;
1515 } else {
1516 di.acl_mtu = hdev->le_mtu;
1517 di.acl_pkts = hdev->le_pkts;
1518 di.sco_mtu = 0;
1519 di.sco_pkts = 0;
1520 }
1da177e4
LT		 1521 di.link_policy = hdev->link_policy;
1522 di.link_mode = hdev->link_mode;
1523
1524 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1525 memcpy(&di.features, &hdev->features, sizeof(di.features));
1526
1527 if (copy_to_user(arg, &di, sizeof(di)))
1528 err = -EFAULT;
1529
1530 hci_dev_put(hdev);
1531
1532 return err;
1533}
1534
1535/* ---- Interface to HCI drivers ---- */
1536
611b30f7
MH		 1537static int hci_rfkill_set_block(void *data, bool blocked)
1538{
1539 struct hci_dev *hdev = data;
1540
1541 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1542
1543 if (!blocked)
1544 return 0;
1545
1546 hci_dev_do_close(hdev);
1547
1548 return 0;
1549}
1550
1551static const struct rfkill_ops hci_rfkill_ops = {
1552 .set_block = hci_rfkill_set_block,
1553};
1554
ab81cbf9
JH		 1555static void hci_power_on(struct work_struct *work)
1556{
1557 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1558
1559 BT_DBG("%s", hdev->name);
1560
1561 if (hci_dev_open(hdev->id) < 0)
1562 return;
1563
a8b2d5c2 1564 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
19202573
JH		 1565 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1566 HCI_AUTO_OFF_TIMEOUT);
ab81cbf9 1567
a8b2d5c2 1568 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 1569 mgmt_index_added(hdev);
ab81cbf9
JH		 1570}
1571
1572static void hci_power_off(struct work_struct *work)
1573{
3243553f 1574 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1575 power_off.work);
ab81cbf9
JH		 1576
1577 BT_DBG("%s", hdev->name);
1578
8ee56540 1579 hci_dev_do_close(hdev);
ab81cbf9
JH		 1580}
1581
16ab91ab
JH		 1582static void hci_discov_off(struct work_struct *work)
1583{
1584 struct hci_dev *hdev;
1585 u8 scan = SCAN_PAGE;
1586
1587 hdev = container_of(work, struct hci_dev, discov_off.work);
1588
1589 BT_DBG("%s", hdev->name);
1590
09fd0de5 1591 hci_dev_lock(hdev);
16ab91ab
JH		 1592
1593 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1594
1595 hdev->discov_timeout = 0;
1596
09fd0de5 1597 hci_dev_unlock(hdev);
16ab91ab
JH		 1598}
1599
2aeb9a1a
JH		 1600int hci_uuids_clear(struct hci_dev *hdev)
1601{
4821002c 1602 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1603
4821002c
JH		 1604 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1605 list_del(&uuid->list);
2aeb9a1a
JH		 1606 kfree(uuid);
1607 }
1608
1609 return 0;
1610}
1611
55ed8ca1
JH		 1612int hci_link_keys_clear(struct hci_dev *hdev)
1613{
1614 struct list_head *p, *n;
1615
1616 list_for_each_safe(p, n, &hdev->link_keys) {
1617 struct link_key *key;
1618
1619 key = list_entry(p, struct link_key, list);
1620
1621 list_del(p);
1622 kfree(key);
1623 }
1624
1625 return 0;
1626}
1627
b899efaf
VCG		 1628int hci_smp_ltks_clear(struct hci_dev *hdev)
1629{
1630 struct smp_ltk *k, *tmp;
1631
1632 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1633 list_del(&k->list);
1634 kfree(k);
1635 }
1636
1637 return 0;
1638}
1639
55ed8ca1
JH		 1640struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1641{
8035ded4 1642 struct link_key *k;
55ed8ca1 1643
8035ded4 1644 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1645 if (bacmp(bdaddr, &k->bdaddr) == 0)
1646 return k;
55ed8ca1
JH		 1647
1648 return NULL;
1649}
1650
745c0ce3 1651static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1652 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1653{
1654 /* Legacy key */
1655 if (key_type < 0x03)
745c0ce3 1656 return true;
d25e28ab
JH		 1657
1658 /* Debug keys are insecure so don't store them persistently */
1659 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1660 return false;
d25e28ab
JH		 1661
1662 /* Changed combination key and there's no previous one */
1663 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1664 return false;
d25e28ab
JH		 1665
1666 /* Security mode 3 case */
1667 if (!conn)
745c0ce3 1668 return true;
d25e28ab
JH		 1669
1670 /* Neither local nor remote side had no-bonding as requirement */
1671 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1672 return true;
d25e28ab
JH		 1673
1674 /* Local side had dedicated bonding as requirement */
1675 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1676 return true;
d25e28ab
JH		 1677
1678 /* Remote side had dedicated bonding as requirement */
1679 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1680 return true;
d25e28ab
JH		 1681
1682 /* If none of the above criteria match, then don't store the key
1683 * persistently */
745c0ce3 1684 return false;
d25e28ab
JH		 1685}
1686
c9839a11 1687struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 1688{
c9839a11 1689 struct smp_ltk *k;
75d262c2 1690
c9839a11
VCG		 1691 list_for_each_entry(k, &hdev->long_term_keys, list) {
1692 if (k->ediv != ediv ||
a8c5fb1a 1693 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 1694 continue;
1695
c9839a11 1696 return k;
75d262c2
VCG		 1697 }
1698
1699 return NULL;
1700}
75d262c2 1701
c9839a11 1702struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 1703 u8 addr_type)
75d262c2 1704{
c9839a11 1705 struct smp_ltk *k;
75d262c2 1706
c9839a11
VCG		 1707 list_for_each_entry(k, &hdev->long_term_keys, list)
1708 if (addr_type == k->bdaddr_type &&
a8c5fb1a 1709 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 1710 return k;
1711
1712 return NULL;
1713}
75d262c2 1714
d25e28ab 1715int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
04124681 1716 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1717{
1718 struct link_key *key, *old_key;
745c0ce3
VA		 1719 u8 old_key_type;
1720 bool persistent;
55ed8ca1
JH		 1721
1722 old_key = hci_find_link_key(hdev, bdaddr);
1723 if (old_key) {
1724 old_key_type = old_key->type;
1725 key = old_key;
1726 } else {
12adcf3a 1727 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1728 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1729 if (!key)
1730 return -ENOMEM;
1731 list_add(&key->list, &hdev->link_keys);
1732 }
1733
6ed93dc6 1734 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1735
d25e28ab
JH		 1736 /* Some buggy controller combinations generate a changed
1737 * combination key for legacy pairing even when there's no
1738 * previous key */
1739 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1740 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1741 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1742 if (conn)
1743 conn->key_type = type;
1744 }
d25e28ab 1745
55ed8ca1 1746 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1747 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1748 key->pin_len = pin_len;
1749
b6020ba0 1750 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1751 key->type = old_key_type;
4748fed2
JH		 1752 else
1753 key->type = type;
1754
4df378a1
JH		 1755 if (!new_key)
1756 return 0;
1757
1758 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1759
744cf19e 1760 mgmt_new_link_key(hdev, key, persistent);
4df378a1 1761
6ec5bcad
VA		 1762 if (conn)
1763 conn->flush_key = !persistent;
55ed8ca1
JH		 1764
1765 return 0;
1766}
1767
c9839a11 1768int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
9a006657 1769 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
04124681 1770 ediv, u8 rand[8])
75d262c2 1771{
c9839a11 1772 struct smp_ltk *key, *old_key;
75d262c2 1773
c9839a11
VCG		 1774 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1775 return 0;
75d262c2 1776
c9839a11
VCG		 1777 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1778 if (old_key)
75d262c2 1779 key = old_key;
c9839a11
VCG		 1780 else {
1781 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 1782 if (!key)
1783 return -ENOMEM;
c9839a11 1784 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1785 }
1786
75d262c2 1787 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1788 key->bdaddr_type = addr_type;
1789 memcpy(key->val, tk, sizeof(key->val));
1790 key->authenticated = authenticated;
1791 key->ediv = ediv;
1792 key->enc_size = enc_size;
1793 key->type = type;
1794 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 1795
c9839a11
VCG		 1796 if (!new_key)
1797 return 0;
75d262c2 1798
261cc5aa
VCG		 1799 if (type & HCI_SMP_LTK)
1800 mgmt_new_ltk(hdev, key, 1);
1801
75d262c2
VCG		 1802 return 0;
1803}
1804
55ed8ca1
JH		 1805int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1806{
1807 struct link_key *key;
1808
1809 key = hci_find_link_key(hdev, bdaddr);
1810 if (!key)
1811 return -ENOENT;
1812
6ed93dc6 1813 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 1814
1815 list_del(&key->list);
1816 kfree(key);
1817
1818 return 0;
1819}
1820
b899efaf
VCG		 1821int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1822{
1823 struct smp_ltk *k, *tmp;
1824
1825 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1826 if (bacmp(bdaddr, &k->bdaddr))
1827 continue;
1828
6ed93dc6 1829 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 1830
1831 list_del(&k->list);
1832 kfree(k);
1833 }
1834
1835 return 0;
1836}
1837
6bd32326 1838/* HCI command timer function */
bda4f23a 1839static void hci_cmd_timeout(unsigned long arg)
6bd32326
VT		 1840{
1841 struct hci_dev *hdev = (void *) arg;
1842
bda4f23a
AE		 1843 if (hdev->sent_cmd) {
1844 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1845 u16 opcode = __le16_to_cpu(sent->opcode);
1846
1847 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1848 } else {
1849 BT_ERR("%s command tx timeout", hdev->name);
1850 }
1851
6bd32326 1852 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1853 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1854}
1855
2763eda6 1856struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 1857 bdaddr_t *bdaddr)
2763eda6
SJ		 1858{
1859 struct oob_data *data;
1860
1861 list_for_each_entry(data, &hdev->remote_oob_data, list)
1862 if (bacmp(bdaddr, &data->bdaddr) == 0)
1863 return data;
1864
1865 return NULL;
1866}
1867
1868int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1869{
1870 struct oob_data *data;
1871
1872 data = hci_find_remote_oob_data(hdev, bdaddr);
1873 if (!data)
1874 return -ENOENT;
1875
6ed93dc6 1876 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1877
1878 list_del(&data->list);
1879 kfree(data);
1880
1881 return 0;
1882}
1883
1884int hci_remote_oob_data_clear(struct hci_dev *hdev)
1885{
1886 struct oob_data *data, *n;
1887
1888 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1889 list_del(&data->list);
1890 kfree(data);
1891 }
1892
1893 return 0;
1894}
1895
1896int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
04124681 1897 u8 *randomizer)
2763eda6
SJ		 1898{
1899 struct oob_data *data;
1900
1901 data = hci_find_remote_oob_data(hdev, bdaddr);
1902
1903 if (!data) {
1904 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1905 if (!data)
1906 return -ENOMEM;
1907
1908 bacpy(&data->bdaddr, bdaddr);
1909 list_add(&data->list, &hdev->remote_oob_data);
1910 }
1911
1912 memcpy(data->hash, hash, sizeof(data->hash));
1913 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1914
6ed93dc6 1915 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1916
1917 return 0;
1918}
1919
04124681 1920struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
b2a66aad 1921{
8035ded4 1922 struct bdaddr_list *b;
b2a66aad 1923
8035ded4 1924 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1925 if (bacmp(bdaddr, &b->bdaddr) == 0)
1926 return b;
b2a66aad
AJ		 1927
1928 return NULL;
1929}
1930
1931int hci_blacklist_clear(struct hci_dev *hdev)
1932{
1933 struct list_head *p, *n;
1934
1935 list_for_each_safe(p, n, &hdev->blacklist) {
1936 struct bdaddr_list *b;
1937
1938 b = list_entry(p, struct bdaddr_list, list);
1939
1940 list_del(p);
1941 kfree(b);
1942 }
1943
1944 return 0;
1945}
1946
88c1fe4b 1947int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1948{
1949 struct bdaddr_list *entry;
b2a66aad
AJ		 1950
1951 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1952 return -EBADF;
1953
5e762444
AJ		 1954 if (hci_blacklist_lookup(hdev, bdaddr))
1955 return -EEXIST;
b2a66aad
AJ		 1956
1957 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1958 if (!entry)
1959 return -ENOMEM;
b2a66aad
AJ		 1960
1961 bacpy(&entry->bdaddr, bdaddr);
1962
1963 list_add(&entry->list, &hdev->blacklist);
1964
88c1fe4b 1965 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 1966}
1967
88c1fe4b 1968int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1969{
1970 struct bdaddr_list *entry;
b2a66aad 1971
1ec918ce 1972 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 1973 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 1974
1975 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 1976 if (!entry)
5e762444 1977 return -ENOENT;
b2a66aad
AJ		 1978
1979 list_del(&entry->list);
1980 kfree(entry);
1981
88c1fe4b 1982 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 1983}
1984
42c6b129 1985static void le_scan_param_req(struct hci_request *req, unsigned long opt)
7ba8b4be
AG		 1986{
1987 struct le_scan_params *param = (struct le_scan_params *) opt;
1988 struct hci_cp_le_set_scan_param cp;
1989
1990 memset(&cp, 0, sizeof(cp));
1991 cp.type = param->type;
1992 cp.interval = cpu_to_le16(param->interval);
1993 cp.window = cpu_to_le16(param->window);
1994
42c6b129 1995 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
7ba8b4be
AG		 1996}
1997
42c6b129 1998static void le_scan_enable_req(struct hci_request *req, unsigned long opt)
7ba8b4be
AG		 1999{
2000 struct hci_cp_le_set_scan_enable cp;
2001
2002 memset(&cp, 0, sizeof(cp));
76a388be 2003 cp.enable = LE_SCAN_ENABLE;
525e296a 2004 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
7ba8b4be 2005
42c6b129 2006 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
7ba8b4be
AG		 2007}
2008
2009static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
04124681 2010 u16 window, int timeout)
7ba8b4be
AG		 2011{
2012 long timeo = msecs_to_jiffies(3000);
2013 struct le_scan_params param;
2014 int err;
2015
2016 BT_DBG("%s", hdev->name);
2017
2018 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
2019 return -EINPROGRESS;
2020
2021 param.type = type;
2022 param.interval = interval;
2023 param.window = window;
2024
2025 hci_req_lock(hdev);
2026
01178cd4
JH		 2027 err = __hci_req_sync(hdev, le_scan_param_req, (unsigned long) &param,
2028 timeo);
7ba8b4be 2029 if (!err)
01178cd4 2030 err = __hci_req_sync(hdev, le_scan_enable_req, 0, timeo);
7ba8b4be
AG		 2031
2032 hci_req_unlock(hdev);
2033
2034 if (err < 0)
2035 return err;
2036
46818ed5 2037 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
b6c7515a 2038 timeout);
7ba8b4be
AG		 2039
2040 return 0;
2041}
2042
7dbfac1d
AG		 2043int hci_cancel_le_scan(struct hci_dev *hdev)
2044{
2045 BT_DBG("%s", hdev->name);
2046
2047 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
2048 return -EALREADY;
2049
2050 if (cancel_delayed_work(&hdev->le_scan_disable)) {
2051 struct hci_cp_le_set_scan_enable cp;
2052
2053 /* Send HCI command to disable LE Scan */
2054 memset(&cp, 0, sizeof(cp));
2055 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2056 }
2057
2058 return 0;
2059}
2060
7ba8b4be
AG		 2061static void le_scan_disable_work(struct work_struct *work)
2062{
2063 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 2064 le_scan_disable.work);
7ba8b4be
AG		 2065 struct hci_cp_le_set_scan_enable cp;
2066
2067 BT_DBG("%s", hdev->name);
2068
2069 memset(&cp, 0, sizeof(cp));
2070
2071 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2072}
2073
28b75a89
AG		 2074static void le_scan_work(struct work_struct *work)
2075{
2076 struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
2077 struct le_scan_params *param = &hdev->le_scan_params;
2078
2079 BT_DBG("%s", hdev->name);
2080
04124681
GP		 2081 hci_do_le_scan(hdev, param->type, param->interval, param->window,
2082 param->timeout);
28b75a89
AG		 2083}
2084
2085int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
04124681 2086 int timeout)
28b75a89
AG		 2087{
2088 struct le_scan_params *param = &hdev->le_scan_params;
2089
2090 BT_DBG("%s", hdev->name);
2091
f1550478
JH		 2092 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
2093 return -ENOTSUPP;
2094
28b75a89
AG		 2095 if (work_busy(&hdev->le_scan))
2096 return -EINPROGRESS;
2097
2098 param->type = type;
2099 param->interval = interval;
2100 param->window = window;
2101 param->timeout = timeout;
2102
2103 queue_work(system_long_wq, &hdev->le_scan);
2104
2105 return 0;
2106}
2107
9be0dab7
DH		 2108/* Alloc HCI device */
2109struct hci_dev *hci_alloc_dev(void)
2110{
2111 struct hci_dev *hdev;
2112
2113 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2114 if (!hdev)
2115 return NULL;
2116
b1b813d4
DH		 2117 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2118 hdev->esco_type = (ESCO_HV1);
2119 hdev->link_mode = (HCI_LM_ACCEPT);
2120 hdev->io_capability = 0x03; /* No Input No Output */
bbaf444a
JH		 2121 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2122 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 2123
b1b813d4
DH		 2124 hdev->sniff_max_interval = 800;
2125 hdev->sniff_min_interval = 80;
2126
2127 mutex_init(&hdev->lock);
2128 mutex_init(&hdev->req_lock);
2129
2130 INIT_LIST_HEAD(&hdev->mgmt_pending);
2131 INIT_LIST_HEAD(&hdev->blacklist);
2132 INIT_LIST_HEAD(&hdev->uuids);
2133 INIT_LIST_HEAD(&hdev->link_keys);
2134 INIT_LIST_HEAD(&hdev->long_term_keys);
2135 INIT_LIST_HEAD(&hdev->remote_oob_data);
6b536b5e 2136 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 2137
2138 INIT_WORK(&hdev->rx_work, hci_rx_work);
2139 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2140 INIT_WORK(&hdev->tx_work, hci_tx_work);
2141 INIT_WORK(&hdev->power_on, hci_power_on);
2142 INIT_WORK(&hdev->le_scan, le_scan_work);
2143
b1b813d4
DH		 2144 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2145 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2146 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2147
b1b813d4
DH		 2148 skb_queue_head_init(&hdev->rx_q);
2149 skb_queue_head_init(&hdev->cmd_q);
2150 skb_queue_head_init(&hdev->raw_q);
2151
2152 init_waitqueue_head(&hdev->req_wait_q);
2153
bda4f23a 2154 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
b1b813d4 2155
b1b813d4
DH		 2156 hci_init_sysfs(hdev);
2157 discovery_init(hdev);
9be0dab7
DH		 2158
2159 return hdev;
2160}
2161EXPORT_SYMBOL(hci_alloc_dev);
2162
2163/* Free HCI device */
2164void hci_free_dev(struct hci_dev *hdev)
2165{
9be0dab7
DH		 2166 /* will free via device release */
2167 put_device(&hdev->dev);
2168}
2169EXPORT_SYMBOL(hci_free_dev);
2170
1da177e4
LT		 2171/* Register HCI device */
2172int hci_register_dev(struct hci_dev *hdev)
2173{
b1b813d4 2174 int id, error;
1da177e4 2175
010666a1 2176 if (!hdev->open || !hdev->close)
1da177e4
LT		 2177 return -EINVAL;
2178
08add513
MM		 2179 /* Do not allow HCI_AMP devices to register at index 0,
2180 * so the index can be used as the AMP controller ID.
2181 */
3df92b31
SL		 2182 switch (hdev->dev_type) {
2183 case HCI_BREDR:
2184 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2185 break;
2186 case HCI_AMP:
2187 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2188 break;
2189 default:
2190 return -EINVAL;
1da177e4 2191 }
8e87d142 2192
3df92b31
SL		 2193 if (id < 0)
2194 return id;
2195
1da177e4
LT		 2196 sprintf(hdev->name, "hci%d", id);
2197 hdev->id = id;
2d8b3a11
AE		 2198
2199 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2200
3df92b31
SL		 2201 write_lock(&hci_dev_list_lock);
2202 list_add(&hdev->list, &hci_dev_list);
f20d09d5 2203 write_unlock(&hci_dev_list_lock);
1da177e4 2204
32845eb1 2205 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
a8c5fb1a 2206 WQ_MEM_RECLAIM, 1);
33ca954d
DH		 2207 if (!hdev->workqueue) {
2208 error = -ENOMEM;
2209 goto err;
2210 }
f48fd9c8 2211
6ead1bbc
JH		 2212 hdev->req_workqueue = alloc_workqueue(hdev->name,
2213 WQ_HIGHPRI | WQ_UNBOUND |
2214 WQ_MEM_RECLAIM, 1);
2215 if (!hdev->req_workqueue) {
2216 destroy_workqueue(hdev->workqueue);
2217 error = -ENOMEM;
2218 goto err;
2219 }
2220
33ca954d
DH		 2221 error = hci_add_sysfs(hdev);
2222 if (error < 0)
2223 goto err_wqueue;
1da177e4 2224
611b30f7 2225 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2226 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2227 hdev);
611b30f7
MH		 2228 if (hdev->rfkill) {
2229 if (rfkill_register(hdev->rfkill) < 0) {
2230 rfkill_destroy(hdev->rfkill);
2231 hdev->rfkill = NULL;
2232 }
2233 }
2234
a8b2d5c2 2235 set_bit(HCI_SETUP, &hdev->dev_flags);
ce2be9ac
AE		 2236
2237 if (hdev->dev_type != HCI_AMP)
2238 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2239
1da177e4 2240 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 2241 hci_dev_hold(hdev);
1da177e4 2242
19202573 2243 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2244
1da177e4 2245 return id;
f48fd9c8 2246
33ca954d
DH		 2247err_wqueue:
2248 destroy_workqueue(hdev->workqueue);
6ead1bbc 2249 destroy_workqueue(hdev->req_workqueue);
33ca954d 2250err:
3df92b31 2251 ida_simple_remove(&hci_index_ida, hdev->id);
f20d09d5 2252 write_lock(&hci_dev_list_lock);
f48fd9c8 2253 list_del(&hdev->list);
f20d09d5 2254 write_unlock(&hci_dev_list_lock);
f48fd9c8 2255
33ca954d 2256 return error;
1da177e4
LT		 2257}
2258EXPORT_SYMBOL(hci_register_dev);
2259
2260/* Unregister HCI device */
59735631 2261void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2262{
3df92b31 2263 int i, id;
ef222013 2264
c13854ce 2265 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2266
94324962
JH		 2267 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
2268
3df92b31
SL		 2269 id = hdev->id;
2270
f20d09d5 2271 write_lock(&hci_dev_list_lock);
1da177e4 2272 list_del(&hdev->list);
f20d09d5 2273 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 2274
2275 hci_dev_do_close(hdev);
2276
cd4c5391 2277 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 2278 kfree_skb(hdev->reassembly[i]);
2279
b9b5ef18
GP		 2280 cancel_work_sync(&hdev->power_on);
2281
ab81cbf9 2282 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8c5fb1a 2283 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 2284 hci_dev_lock(hdev);
744cf19e 2285 mgmt_index_removed(hdev);
09fd0de5 2286 hci_dev_unlock(hdev);
56e5cb86 2287 }
ab81cbf9 2288
2e58ef3e
JH		 2289 /* mgmt_index_removed should take care of emptying the
2290 * pending list */
2291 BUG_ON(!list_empty(&hdev->mgmt_pending));
2292
1da177e4
LT		 2293 hci_notify(hdev, HCI_DEV_UNREG);
2294
611b30f7
MH		 2295 if (hdev->rfkill) {
2296 rfkill_unregister(hdev->rfkill);
2297 rfkill_destroy(hdev->rfkill);
2298 }
2299
ce242970 2300 hci_del_sysfs(hdev);
147e2d59 2301
f48fd9c8 2302 destroy_workqueue(hdev->workqueue);
6ead1bbc 2303 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2304
09fd0de5 2305 hci_dev_lock(hdev);
e2e0cacb 2306 hci_blacklist_clear(hdev);
2aeb9a1a 2307 hci_uuids_clear(hdev);
55ed8ca1 2308 hci_link_keys_clear(hdev);
b899efaf 2309 hci_smp_ltks_clear(hdev);
2763eda6 2310 hci_remote_oob_data_clear(hdev);
09fd0de5 2311 hci_dev_unlock(hdev);
e2e0cacb 2312
dc946bd8 2313 hci_dev_put(hdev);
3df92b31
SL		 2314
2315 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 2316}
2317EXPORT_SYMBOL(hci_unregister_dev);
2318
2319/* Suspend HCI device */
2320int hci_suspend_dev(struct hci_dev *hdev)
2321{
2322 hci_notify(hdev, HCI_DEV_SUSPEND);
2323 return 0;
2324}
2325EXPORT_SYMBOL(hci_suspend_dev);
2326
2327/* Resume HCI device */
2328int hci_resume_dev(struct hci_dev *hdev)
2329{
2330 hci_notify(hdev, HCI_DEV_RESUME);
2331 return 0;
2332}
2333EXPORT_SYMBOL(hci_resume_dev);
2334
76bca880
MH		 2335/* Receive frame from HCI drivers */
2336int hci_recv_frame(struct sk_buff *skb)
2337{
2338 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2339 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2340 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2341 kfree_skb(skb);
2342 return -ENXIO;
2343 }
2344
d82603c6 2345 /* Incoming skb */
76bca880
MH		 2346 bt_cb(skb)->incoming = 1;
2347
2348 /* Time stamp */
2349 __net_timestamp(skb);
2350
76bca880 2351 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2352 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2353
76bca880
MH		 2354 return 0;
2355}
2356EXPORT_SYMBOL(hci_recv_frame);
2357
33e882a5 2358static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 2359 int count, __u8 index)
33e882a5
SS		 2360{
2361 int len = 0;
2362 int hlen = 0;
2363 int remain = count;
2364 struct sk_buff *skb;
2365 struct bt_skb_cb *scb;
2366
2367 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 2368 index >= NUM_REASSEMBLY)
33e882a5
SS		 2369 return -EILSEQ;
2370
2371 skb = hdev->reassembly[index];
2372
2373 if (!skb) {
2374 switch (type) {
2375 case HCI_ACLDATA_PKT:
2376 len = HCI_MAX_FRAME_SIZE;
2377 hlen = HCI_ACL_HDR_SIZE;
2378 break;
2379 case HCI_EVENT_PKT:
2380 len = HCI_MAX_EVENT_SIZE;
2381 hlen = HCI_EVENT_HDR_SIZE;
2382 break;
2383 case HCI_SCODATA_PKT:
2384 len = HCI_MAX_SCO_SIZE;
2385 hlen = HCI_SCO_HDR_SIZE;
2386 break;
2387 }
2388
1e429f38 2389 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 2390 if (!skb)
2391 return -ENOMEM;
2392
2393 scb = (void *) skb->cb;
2394 scb->expect = hlen;
2395 scb->pkt_type = type;
2396
2397 skb->dev = (void *) hdev;
2398 hdev->reassembly[index] = skb;
2399 }
2400
2401 while (count) {
2402 scb = (void *) skb->cb;
89bb46d0 2403 len = min_t(uint, scb->expect, count);
33e882a5
SS		 2404
2405 memcpy(skb_put(skb, len), data, len);
2406
2407 count -= len;
2408 data += len;
2409 scb->expect -= len;
2410 remain = count;
2411
2412 switch (type) {
2413 case HCI_EVENT_PKT:
2414 if (skb->len == HCI_EVENT_HDR_SIZE) {
2415 struct hci_event_hdr *h = hci_event_hdr(skb);
2416 scb->expect = h->plen;
2417
2418 if (skb_tailroom(skb) < scb->expect) {
2419 kfree_skb(skb);
2420 hdev->reassembly[index] = NULL;
2421 return -ENOMEM;
2422 }
2423 }
2424 break;
2425
2426 case HCI_ACLDATA_PKT:
2427 if (skb->len == HCI_ACL_HDR_SIZE) {
2428 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2429 scb->expect = __le16_to_cpu(h->dlen);
2430
2431 if (skb_tailroom(skb) < scb->expect) {
2432 kfree_skb(skb);
2433 hdev->reassembly[index] = NULL;
2434 return -ENOMEM;
2435 }
2436 }
2437 break;
2438
2439 case HCI_SCODATA_PKT:
2440 if (skb->len == HCI_SCO_HDR_SIZE) {
2441 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2442 scb->expect = h->dlen;
2443
2444 if (skb_tailroom(skb) < scb->expect) {
2445 kfree_skb(skb);
2446 hdev->reassembly[index] = NULL;
2447 return -ENOMEM;
2448 }
2449 }
2450 break;
2451 }
2452
2453 if (scb->expect == 0) {
2454 /* Complete frame */
2455
2456 bt_cb(skb)->pkt_type = type;
2457 hci_recv_frame(skb);
2458
2459 hdev->reassembly[index] = NULL;
2460 return remain;
2461 }
2462 }
2463
2464 return remain;
2465}
2466
ef222013
MH		 2467int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2468{
f39a3c06
SS		 2469 int rem = 0;
2470
ef222013
MH		 2471 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2472 return -EILSEQ;
2473
da5f6c37 2474 while (count) {
1e429f38 2475 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 2476 if (rem < 0)
2477 return rem;
ef222013 2478
f39a3c06
SS		 2479 data += (count - rem);
2480 count = rem;
f81c6224 2481 }
ef222013 2482
f39a3c06 2483 return rem;
ef222013
MH		 2484}
2485EXPORT_SYMBOL(hci_recv_fragment);
2486
99811510
SS		 2487#define STREAM_REASSEMBLY 0
2488
2489int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2490{
2491 int type;
2492 int rem = 0;
2493
da5f6c37 2494 while (count) {
99811510
SS		 2495 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2496
2497 if (!skb) {
2498 struct { char type; } *pkt;
2499
2500 /* Start of the frame */
2501 pkt = data;
2502 type = pkt->type;
2503
2504 data++;
2505 count--;
2506 } else
2507 type = bt_cb(skb)->pkt_type;
2508
1e429f38 2509 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 2510 STREAM_REASSEMBLY);
99811510
SS		 2511 if (rem < 0)
2512 return rem;
2513
2514 data += (count - rem);
2515 count = rem;
f81c6224 2516 }
99811510
SS		 2517
2518 return rem;
2519}
2520EXPORT_SYMBOL(hci_recv_stream_fragment);
2521
1da177e4
LT		 2522/* ---- Interface to upper protocols ---- */
2523
1da177e4
LT		 2524int hci_register_cb(struct hci_cb *cb)
2525{
2526 BT_DBG("%p name %s", cb, cb->name);
2527
f20d09d5 2528 write_lock(&hci_cb_list_lock);
1da177e4 2529 list_add(&cb->list, &hci_cb_list);
f20d09d5 2530 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2531
2532 return 0;
2533}
2534EXPORT_SYMBOL(hci_register_cb);
2535
2536int hci_unregister_cb(struct hci_cb *cb)
2537{
2538 BT_DBG("%p name %s", cb, cb->name);
2539
f20d09d5 2540 write_lock(&hci_cb_list_lock);
1da177e4 2541 list_del(&cb->list);
f20d09d5 2542 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2543
2544 return 0;
2545}
2546EXPORT_SYMBOL(hci_unregister_cb);
2547
2548static int hci_send_frame(struct sk_buff *skb)
2549{
2550 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2551
2552 if (!hdev) {
2553 kfree_skb(skb);
2554 return -ENODEV;
2555 }
2556
0d48d939 2557 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 2558
cd82e61c
MH		 2559 /* Time stamp */
2560 __net_timestamp(skb);
1da177e4 2561
cd82e61c
MH		 2562 /* Send copy to monitor */
2563 hci_send_to_monitor(hdev, skb);
2564
2565 if (atomic_read(&hdev->promisc)) {
2566 /* Send copy to the sockets */
470fe1b5 2567 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2568 }
2569
2570 /* Get rid of skb owner, prior to sending to the driver. */
2571 skb_orphan(skb);
2572
2573 return hdev->send(skb);
2574}
2575
3119ae95
JH		 2576void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
2577{
2578 skb_queue_head_init(&req->cmd_q);
2579 req->hdev = hdev;
5d73e034 2580 req->err = 0;
3119ae95
JH		 2581}
2582
2583int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
2584{
2585 struct hci_dev *hdev = req->hdev;
2586 struct sk_buff *skb;
2587 unsigned long flags;
2588
2589 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
2590
5d73e034
AG		 2591 /* If an error occured during request building, remove all HCI
2592 * commands queued on the HCI request queue.
2593 */
2594 if (req->err) {
2595 skb_queue_purge(&req->cmd_q);
2596 return req->err;
2597 }
2598
3119ae95
JH		 2599 /* Do not allow empty requests */
2600 if (skb_queue_empty(&req->cmd_q))
382b0c39 2601 return -ENODATA;
3119ae95
JH		 2602
2603 skb = skb_peek_tail(&req->cmd_q);
2604 bt_cb(skb)->req.complete = complete;
2605
2606 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
2607 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
2608 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
2609
2610 queue_work(hdev->workqueue, &hdev->cmd_work);
2611
2612 return 0;
2613}
2614
1ca3a9d0 2615static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
07dc93dd 2616 u32 plen, const void *param)
1da177e4
LT		 2617{
2618 int len = HCI_COMMAND_HDR_SIZE + plen;
2619 struct hci_command_hdr *hdr;
2620 struct sk_buff *skb;
2621
1da177e4 2622 skb = bt_skb_alloc(len, GFP_ATOMIC);
1ca3a9d0
JH		 2623 if (!skb)
2624 return NULL;
1da177e4
LT		 2625
2626 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 2627 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 2628 hdr->plen = plen;
2629
2630 if (plen)
2631 memcpy(skb_put(skb, plen), param, plen);
2632
2633 BT_DBG("skb len %d", skb->len);
2634
0d48d939 2635 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 2636 skb->dev = (void *) hdev;
c78ae283 2637
1ca3a9d0
JH		 2638 return skb;
2639}
2640
2641/* Send HCI command */
07dc93dd
JH		 2642int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2643 const void *param)
1ca3a9d0
JH		 2644{
2645 struct sk_buff *skb;
2646
2647 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2648
2649 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2650 if (!skb) {
2651 BT_ERR("%s no memory for command", hdev->name);
2652 return -ENOMEM;
2653 }
2654
11714b3d
JH		 2655 /* Stand-alone HCI commands must be flaged as
2656 * single-command requests.
2657 */
2658 bt_cb(skb)->req.start = true;
2659
1da177e4 2660 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 2661 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2662
2663 return 0;
2664}
1da177e4 2665
71c76a17 2666/* Queue a command to an asynchronous HCI request */
07dc93dd
JH		 2667void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
2668 const void *param, u8 event)
71c76a17
JH		 2669{
2670 struct hci_dev *hdev = req->hdev;
2671 struct sk_buff *skb;
2672
2673 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2674
34739c1e
AG		 2675 /* If an error occured during request building, there is no point in
2676 * queueing the HCI command. We can simply return.
2677 */
2678 if (req->err)
2679 return;
2680
71c76a17
JH		 2681 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2682 if (!skb) {
5d73e034
AG		 2683 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
2684 hdev->name, opcode);
2685 req->err = -ENOMEM;
e348fe6b 2686 return;
71c76a17
JH		 2687 }
2688
2689 if (skb_queue_empty(&req->cmd_q))
2690 bt_cb(skb)->req.start = true;
2691
02350a72
JH		 2692 bt_cb(skb)->req.event = event;
2693
71c76a17 2694 skb_queue_tail(&req->cmd_q, skb);
71c76a17
JH		 2695}
2696
07dc93dd
JH		 2697void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
2698 const void *param)
02350a72
JH		 2699{
2700 hci_req_add_ev(req, opcode, plen, param, 0);
2701}
2702
1da177e4 2703/* Get data from the previously sent command */
a9de9248 2704void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 2705{
2706 struct hci_command_hdr *hdr;
2707
2708 if (!hdev->sent_cmd)
2709 return NULL;
2710
2711 hdr = (void *) hdev->sent_cmd->data;
2712
a9de9248 2713 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 2714 return NULL;
2715
f0e09510 2716 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 2717
2718 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2719}
2720
2721/* Send ACL data */
2722static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2723{
2724 struct hci_acl_hdr *hdr;
2725 int len = skb->len;
2726
badff6d0
ACM		 2727 skb_push(skb, HCI_ACL_HDR_SIZE);
2728 skb_reset_transport_header(skb);
9c70220b 2729 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 2730 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2731 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 2732}
2733
ee22be7e 2734static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 2735 struct sk_buff *skb, __u16 flags)
1da177e4 2736{
ee22be7e 2737 struct hci_conn *conn = chan->conn;
1da177e4
LT		 2738 struct hci_dev *hdev = conn->hdev;
2739 struct sk_buff *list;
2740
087bfd99
GP		 2741 skb->len = skb_headlen(skb);
2742 skb->data_len = 0;
2743
2744 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 2745
2746 switch (hdev->dev_type) {
2747 case HCI_BREDR:
2748 hci_add_acl_hdr(skb, conn->handle, flags);
2749 break;
2750 case HCI_AMP:
2751 hci_add_acl_hdr(skb, chan->handle, flags);
2752 break;
2753 default:
2754 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2755 return;
2756 }
087bfd99 2757
70f23020
AE		 2758 list = skb_shinfo(skb)->frag_list;
2759 if (!list) {
1da177e4
LT		 2760 /* Non fragmented */
2761 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2762
73d80deb 2763 skb_queue_tail(queue, skb);
1da177e4
LT		 2764 } else {
2765 /* Fragmented */
2766 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2767
2768 skb_shinfo(skb)->frag_list = NULL;
2769
2770 /* Queue all fragments atomically */
af3e6359 2771 spin_lock(&queue->lock);
1da177e4 2772
73d80deb 2773 __skb_queue_tail(queue, skb);
e702112f
AE		 2774
2775 flags &= ~ACL_START;
2776 flags |= ACL_CONT;
1da177e4
LT		 2777 do {
2778 skb = list; list = list->next;
8e87d142 2779
1da177e4 2780 skb->dev = (void *) hdev;
0d48d939 2781 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2782 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2783
2784 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2785
73d80deb 2786 __skb_queue_tail(queue, skb);
1da177e4
LT		 2787 } while (list);
2788
af3e6359 2789 spin_unlock(&queue->lock);
1da177e4 2790 }
73d80deb
LAD		 2791}
2792
2793void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2794{
ee22be7e 2795 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 2796
f0e09510 2797 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb
LAD		 2798
2799 skb->dev = (void *) hdev;
73d80deb 2800
ee22be7e 2801 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 2802
3eff45ea 2803 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2804}
1da177e4
LT		 2805
2806/* Send SCO data */
0d861d8b 2807void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2808{
2809 struct hci_dev *hdev = conn->hdev;
2810 struct hci_sco_hdr hdr;
2811
2812 BT_DBG("%s len %d", hdev->name, skb->len);
2813
aca3192c 2814 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2815 hdr.dlen = skb->len;
2816
badff6d0
ACM		 2817 skb_push(skb, HCI_SCO_HDR_SIZE);
2818 skb_reset_transport_header(skb);
9c70220b 2819 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2820
2821 skb->dev = (void *) hdev;
0d48d939 2822 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2823
1da177e4 2824 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2825 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2826}
1da177e4
LT		 2827
2828/* ---- HCI TX task (outgoing data) ---- */
2829
2830/* HCI Connection scheduler */
6039aa73
GP		 2831static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2832 int *quote)
1da177e4
LT		 2833{
2834 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2835 struct hci_conn *conn = NULL, *c;
abc5de8f 2836 unsigned int num = 0, min = ~0;
1da177e4 2837
8e87d142 2838 /* We don't have to lock device here. Connections are always
1da177e4 2839 * added and removed with TX task disabled. */
bf4c6325
GP		 2840
2841 rcu_read_lock();
2842
2843 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2844 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2845 continue;
769be974
MH		 2846
2847 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2848 continue;
2849
1da177e4
LT		 2850 num++;
2851
2852 if (c->sent < min) {
2853 min = c->sent;
2854 conn = c;
2855 }
52087a79
LAD		 2856
2857 if (hci_conn_num(hdev, type) == num)
2858 break;
1da177e4
LT		 2859 }
2860
bf4c6325
GP		 2861 rcu_read_unlock();
2862
1da177e4 2863 if (conn) {
6ed58ec5
VT		 2864 int cnt, q;
2865
2866 switch (conn->type) {
2867 case ACL_LINK:
2868 cnt = hdev->acl_cnt;
2869 break;
2870 case SCO_LINK:
2871 case ESCO_LINK:
2872 cnt = hdev->sco_cnt;
2873 break;
2874 case LE_LINK:
2875 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2876 break;
2877 default:
2878 cnt = 0;
2879 BT_ERR("Unknown link type");
2880 }
2881
2882 q = cnt / num;
1da177e4
LT		 2883 *quote = q ? q : 1;
2884 } else
2885 *quote = 0;
2886
2887 BT_DBG("conn %p quote %d", conn, *quote);
2888 return conn;
2889}
2890
6039aa73 2891static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2892{
2893 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2894 struct hci_conn *c;
1da177e4 2895
bae1f5d9 2896 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2897
bf4c6325
GP		 2898 rcu_read_lock();
2899
1da177e4 2900 /* Kill stalled connections */
bf4c6325 2901 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 2902 if (c->type == type && c->sent) {
6ed93dc6
AE		 2903 BT_ERR("%s killing stalled connection %pMR",
2904 hdev->name, &c->dst);
bed71748 2905 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 2906 }
2907 }
bf4c6325
GP		 2908
2909 rcu_read_unlock();
1da177e4
LT		 2910}
2911
6039aa73
GP		 2912static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2913 int *quote)
1da177e4 2914{
73d80deb
LAD		 2915 struct hci_conn_hash *h = &hdev->conn_hash;
2916 struct hci_chan *chan = NULL;
abc5de8f 2917 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 2918 struct hci_conn *conn;
73d80deb
LAD		 2919 int cnt, q, conn_num = 0;
2920
2921 BT_DBG("%s", hdev->name);
2922
bf4c6325
GP		 2923 rcu_read_lock();
2924
2925 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2926 struct hci_chan *tmp;
2927
2928 if (conn->type != type)
2929 continue;
2930
2931 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2932 continue;
2933
2934 conn_num++;
2935
8192edef 2936 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2937 struct sk_buff *skb;
2938
2939 if (skb_queue_empty(&tmp->data_q))
2940 continue;
2941
2942 skb = skb_peek(&tmp->data_q);
2943 if (skb->priority < cur_prio)
2944 continue;
2945
2946 if (skb->priority > cur_prio) {
2947 num = 0;
2948 min = ~0;
2949 cur_prio = skb->priority;
2950 }
2951
2952 num++;
2953
2954 if (conn->sent < min) {
2955 min = conn->sent;
2956 chan = tmp;
2957 }
2958 }
2959
2960 if (hci_conn_num(hdev, type) == conn_num)
2961 break;
2962 }
2963
bf4c6325
GP		 2964 rcu_read_unlock();
2965
73d80deb
LAD		 2966 if (!chan)
2967 return NULL;
2968
2969 switch (chan->conn->type) {
2970 case ACL_LINK:
2971 cnt = hdev->acl_cnt;
2972 break;
bd1eb66b
AE		 2973 case AMP_LINK:
2974 cnt = hdev->block_cnt;
2975 break;
73d80deb
LAD		 2976 case SCO_LINK:
2977 case ESCO_LINK:
2978 cnt = hdev->sco_cnt;
2979 break;
2980 case LE_LINK:
2981 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2982 break;
2983 default:
2984 cnt = 0;
2985 BT_ERR("Unknown link type");
2986 }
2987
2988 q = cnt / num;
2989 *quote = q ? q : 1;
2990 BT_DBG("chan %p quote %d", chan, *quote);
2991 return chan;
2992}
2993
02b20f0b
LAD		 2994static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2995{
2996 struct hci_conn_hash *h = &hdev->conn_hash;
2997 struct hci_conn *conn;
2998 int num = 0;
2999
3000 BT_DBG("%s", hdev->name);
3001
bf4c6325
GP		 3002 rcu_read_lock();
3003
3004 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3005 struct hci_chan *chan;
3006
3007 if (conn->type != type)
3008 continue;
3009
3010 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3011 continue;
3012
3013 num++;
3014
8192edef 3015 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3016 struct sk_buff *skb;
3017
3018 if (chan->sent) {
3019 chan->sent = 0;
3020 continue;
3021 }
3022
3023 if (skb_queue_empty(&chan->data_q))
3024 continue;
3025
3026 skb = skb_peek(&chan->data_q);
3027 if (skb->priority >= HCI_PRIO_MAX - 1)
3028 continue;
3029
3030 skb->priority = HCI_PRIO_MAX - 1;
3031
3032 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3033 skb->priority);
02b20f0b
LAD		 3034 }
3035
3036 if (hci_conn_num(hdev, type) == num)
3037 break;
3038 }
bf4c6325
GP		 3039
3040 rcu_read_unlock();
3041
02b20f0b
LAD		 3042}
3043
b71d385a
AE		 3044static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3045{
3046 /* Calculate count of blocks used by this packet */
3047 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3048}
3049
6039aa73 3050static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 3051{
1da177e4
LT		 3052 if (!test_bit(HCI_RAW, &hdev->flags)) {
3053 /* ACL tx timeout must be longer than maximum
3054 * link supervision timeout (40.9 seconds) */
63d2bc1b 3055 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 3056 HCI_ACL_TX_TIMEOUT))
bae1f5d9 3057 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 3058 }
63d2bc1b 3059}
1da177e4 3060
6039aa73 3061static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3062{
3063 unsigned int cnt = hdev->acl_cnt;
3064 struct hci_chan *chan;
3065 struct sk_buff *skb;
3066 int quote;
3067
3068 __check_timeout(hdev, cnt);
04837f64 3069
73d80deb 3070 while (hdev->acl_cnt &&
a8c5fb1a 3071 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3072 u32 priority = (skb_peek(&chan->data_q))->priority;
3073 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3074 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3075 skb->len, skb->priority);
73d80deb 3076
ec1cce24
LAD		 3077 /* Stop if priority has changed */
3078 if (skb->priority < priority)
3079 break;
3080
3081 skb = skb_dequeue(&chan->data_q);
3082
73d80deb 3083 hci_conn_enter_active_mode(chan->conn,
04124681 3084 bt_cb(skb)->force_active);
04837f64 3085
1da177e4
LT		 3086 hci_send_frame(skb);
3087 hdev->acl_last_tx = jiffies;
3088
3089 hdev->acl_cnt--;
73d80deb
LAD		 3090 chan->sent++;
3091 chan->conn->sent++;
1da177e4
LT		 3092 }
3093 }
02b20f0b
LAD		 3094
3095 if (cnt != hdev->acl_cnt)
3096 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3097}
3098
6039aa73 3099static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3100{
63d2bc1b 3101 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3102 struct hci_chan *chan;
3103 struct sk_buff *skb;
3104 int quote;
bd1eb66b 3105 u8 type;
b71d385a 3106
63d2bc1b 3107 __check_timeout(hdev, cnt);
b71d385a 3108
bd1eb66b
AE		 3109 BT_DBG("%s", hdev->name);
3110
3111 if (hdev->dev_type == HCI_AMP)
3112 type = AMP_LINK;
3113 else
3114 type = ACL_LINK;
3115
b71d385a 3116 while (hdev->block_cnt > 0 &&
bd1eb66b 3117 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3118 u32 priority = (skb_peek(&chan->data_q))->priority;
3119 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3120 int blocks;
3121
3122 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3123 skb->len, skb->priority);
b71d385a
AE		 3124
3125 /* Stop if priority has changed */
3126 if (skb->priority < priority)
3127 break;
3128
3129 skb = skb_dequeue(&chan->data_q);
3130
3131 blocks = __get_blocks(hdev, skb);
3132 if (blocks > hdev->block_cnt)
3133 return;
3134
3135 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3136 bt_cb(skb)->force_active);
b71d385a
AE		 3137
3138 hci_send_frame(skb);
3139 hdev->acl_last_tx = jiffies;
3140
3141 hdev->block_cnt -= blocks;
3142 quote -= blocks;
3143
3144 chan->sent += blocks;
3145 chan->conn->sent += blocks;
3146 }
3147 }
3148
3149 if (cnt != hdev->block_cnt)
bd1eb66b 3150 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3151}
3152
6039aa73 3153static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3154{
3155 BT_DBG("%s", hdev->name);
3156
bd1eb66b
AE		 3157 /* No ACL link over BR/EDR controller */
3158 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3159 return;
3160
3161 /* No AMP link over AMP controller */
3162 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3163 return;
3164
3165 switch (hdev->flow_ctl_mode) {
3166 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3167 hci_sched_acl_pkt(hdev);
3168 break;
3169
3170 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3171 hci_sched_acl_blk(hdev);
3172 break;
3173 }
3174}
3175
1da177e4 3176/* Schedule SCO */
6039aa73 3177static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 3178{
3179 struct hci_conn *conn;
3180 struct sk_buff *skb;
3181 int quote;
3182
3183 BT_DBG("%s", hdev->name);
3184
52087a79
LAD		 3185 if (!hci_conn_num(hdev, SCO_LINK))
3186 return;
3187
1da177e4
LT		 3188 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3189 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3190 BT_DBG("skb %p len %d", skb, skb->len);
3191 hci_send_frame(skb);
3192
3193 conn->sent++;
3194 if (conn->sent == ~0)
3195 conn->sent = 0;
3196 }
3197 }
3198}
3199
6039aa73 3200static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 3201{
3202 struct hci_conn *conn;
3203 struct sk_buff *skb;
3204 int quote;
3205
3206 BT_DBG("%s", hdev->name);
3207
52087a79
LAD		 3208 if (!hci_conn_num(hdev, ESCO_LINK))
3209 return;
3210
8fc9ced3
GP		 3211 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3212 &quote))) {
b6a0dc82
MH		 3213 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3214 BT_DBG("skb %p len %d", skb, skb->len);
3215 hci_send_frame(skb);
3216
3217 conn->sent++;
3218 if (conn->sent == ~0)
3219 conn->sent = 0;
3220 }
3221 }
3222}
3223
6039aa73 3224static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3225{
73d80deb 3226 struct hci_chan *chan;
6ed58ec5 3227 struct sk_buff *skb;
02b20f0b 3228 int quote, cnt, tmp;
6ed58ec5
VT		 3229
3230 BT_DBG("%s", hdev->name);
3231
52087a79
LAD		 3232 if (!hci_conn_num(hdev, LE_LINK))
3233 return;
3234
6ed58ec5
VT		 3235 if (!test_bit(HCI_RAW, &hdev->flags)) {
3236 /* LE tx timeout must be longer than maximum
3237 * link supervision timeout (40.9 seconds) */
bae1f5d9 3238 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 3239 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 3240 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 3241 }
3242
3243 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 3244 tmp = cnt;
73d80deb 3245 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3246 u32 priority = (skb_peek(&chan->data_q))->priority;
3247 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3248 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3249 skb->len, skb->priority);
6ed58ec5 3250
ec1cce24
LAD		 3251 /* Stop if priority has changed */
3252 if (skb->priority < priority)
3253 break;
3254
3255 skb = skb_dequeue(&chan->data_q);
3256
6ed58ec5
VT		 3257 hci_send_frame(skb);
3258 hdev->le_last_tx = jiffies;
3259
3260 cnt--;
73d80deb
LAD		 3261 chan->sent++;
3262 chan->conn->sent++;
6ed58ec5
VT		 3263 }
3264 }
73d80deb 3265
6ed58ec5
VT		 3266 if (hdev->le_pkts)
3267 hdev->le_cnt = cnt;
3268 else
3269 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3270
3271 if (cnt != tmp)
3272 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3273}
3274
3eff45ea 3275static void hci_tx_work(struct work_struct *work)
1da177e4 3276{
3eff45ea 3277 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3278 struct sk_buff *skb;
3279
6ed58ec5 3280 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 3281 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 3282
3283 /* Schedule queues and send stuff to HCI driver */
3284
3285 hci_sched_acl(hdev);
3286
3287 hci_sched_sco(hdev);
3288
b6a0dc82
MH		 3289 hci_sched_esco(hdev);
3290
6ed58ec5
VT		 3291 hci_sched_le(hdev);
3292
1da177e4
LT		 3293 /* Send next queued raw (unknown type) packet */
3294 while ((skb = skb_dequeue(&hdev->raw_q)))
3295 hci_send_frame(skb);
1da177e4
LT		 3296}
3297
25985edc 3298/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3299
3300/* ACL data packet */
6039aa73 3301static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3302{
3303 struct hci_acl_hdr *hdr = (void *) skb->data;
3304 struct hci_conn *conn;
3305 __u16 handle, flags;
3306
3307 skb_pull(skb, HCI_ACL_HDR_SIZE);
3308
3309 handle = __le16_to_cpu(hdr->handle);
3310 flags = hci_flags(handle);
3311 handle = hci_handle(handle);
3312
f0e09510 3313 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3314 handle, flags);
1da177e4
LT		 3315
3316 hdev->stat.acl_rx++;
3317
3318 hci_dev_lock(hdev);
3319 conn = hci_conn_hash_lookup_handle(hdev, handle);
3320 hci_dev_unlock(hdev);
8e87d142 3321
1da177e4 3322 if (conn) {
65983fc7 3323 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3324
1da177e4 3325 /* Send to upper protocol */
686ebf28
UF		 3326 l2cap_recv_acldata(conn, skb, flags);
3327 return;
1da177e4 3328 } else {
8e87d142 3329 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 3330 hdev->name, handle);
1da177e4
LT		 3331 }
3332
3333 kfree_skb(skb);
3334}
3335
3336/* SCO data packet */
6039aa73 3337static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3338{
3339 struct hci_sco_hdr *hdr = (void *) skb->data;
3340 struct hci_conn *conn;
3341 __u16 handle;
3342
3343 skb_pull(skb, HCI_SCO_HDR_SIZE);
3344
3345 handle = __le16_to_cpu(hdr->handle);
3346
f0e09510 3347 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 3348
3349 hdev->stat.sco_rx++;
3350
3351 hci_dev_lock(hdev);
3352 conn = hci_conn_hash_lookup_handle(hdev, handle);
3353 hci_dev_unlock(hdev);
3354
3355 if (conn) {
1da177e4 3356 /* Send to upper protocol */
686ebf28
UF		 3357 sco_recv_scodata(conn, skb);
3358 return;
1da177e4 3359 } else {
8e87d142 3360 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 3361 hdev->name, handle);
1da177e4
LT		 3362 }
3363
3364 kfree_skb(skb);
3365}
3366
9238f36a
JH		 3367static bool hci_req_is_complete(struct hci_dev *hdev)
3368{
3369 struct sk_buff *skb;
3370
3371 skb = skb_peek(&hdev->cmd_q);
3372 if (!skb)
3373 return true;
3374
3375 return bt_cb(skb)->req.start;
3376}
3377
42c6b129
JH		 3378static void hci_resend_last(struct hci_dev *hdev)
3379{
3380 struct hci_command_hdr *sent;
3381 struct sk_buff *skb;
3382 u16 opcode;
3383
3384 if (!hdev->sent_cmd)
3385 return;
3386
3387 sent = (void *) hdev->sent_cmd->data;
3388 opcode = __le16_to_cpu(sent->opcode);
3389 if (opcode == HCI_OP_RESET)
3390 return;
3391
3392 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3393 if (!skb)
3394 return;
3395
3396 skb_queue_head(&hdev->cmd_q, skb);
3397 queue_work(hdev->workqueue, &hdev->cmd_work);
3398}
3399
9238f36a
JH		 3400void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
3401{
3402 hci_req_complete_t req_complete = NULL;
3403 struct sk_buff *skb;
3404 unsigned long flags;
3405
3406 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3407
42c6b129
JH		 3408 /* If the completed command doesn't match the last one that was
3409 * sent we need to do special handling of it.
9238f36a 3410 */
42c6b129
JH		 3411 if (!hci_sent_cmd_data(hdev, opcode)) {
3412 /* Some CSR based controllers generate a spontaneous
3413 * reset complete event during init and any pending
3414 * command will never be completed. In such a case we
3415 * need to resend whatever was the last sent
3416 * command.
3417 */
3418 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3419 hci_resend_last(hdev);
3420
9238f36a 3421 return;
42c6b129 3422 }
9238f36a
JH		 3423
3424 /* If the command succeeded and there's still more commands in
3425 * this request the request is not yet complete.
3426 */
3427 if (!status && !hci_req_is_complete(hdev))
3428 return;
3429
3430 /* If this was the last command in a request the complete
3431 * callback would be found in hdev->sent_cmd instead of the
3432 * command queue (hdev->cmd_q).
3433 */
3434 if (hdev->sent_cmd) {
3435 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
3436 if (req_complete)
3437 goto call_complete;
3438 }
3439
3440 /* Remove all pending commands belonging to this request */
3441 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3442 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3443 if (bt_cb(skb)->req.start) {
3444 __skb_queue_head(&hdev->cmd_q, skb);
3445 break;
3446 }
3447
3448 req_complete = bt_cb(skb)->req.complete;
3449 kfree_skb(skb);
3450 }
3451 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3452
3453call_complete:
3454 if (req_complete)
3455 req_complete(hdev, status);
3456}
3457
b78752cc 3458static void hci_rx_work(struct work_struct *work)
1da177e4 3459{
b78752cc 3460 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 3461 struct sk_buff *skb;
3462
3463 BT_DBG("%s", hdev->name);
3464
1da177e4 3465 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 3466 /* Send copy to monitor */
3467 hci_send_to_monitor(hdev, skb);
3468
1da177e4
LT		 3469 if (atomic_read(&hdev->promisc)) {
3470 /* Send copy to the sockets */
470fe1b5 3471 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3472 }
3473
3474 if (test_bit(HCI_RAW, &hdev->flags)) {
3475 kfree_skb(skb);
3476 continue;
3477 }
3478
3479 if (test_bit(HCI_INIT, &hdev->flags)) {
3480 /* Don't process data packets in this states. */
0d48d939 3481 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 3482 case HCI_ACLDATA_PKT:
3483 case HCI_SCODATA_PKT:
3484 kfree_skb(skb);
3485 continue;
3ff50b79 3486 }
1da177e4
LT		 3487 }
3488
3489 /* Process frame */
0d48d939 3490 switch (bt_cb(skb)->pkt_type) {
1da177e4 3491 case HCI_EVENT_PKT:
b78752cc 3492 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 3493 hci_event_packet(hdev, skb);
3494 break;
3495
3496 case HCI_ACLDATA_PKT:
3497 BT_DBG("%s ACL data packet", hdev->name);
3498 hci_acldata_packet(hdev, skb);
3499 break;
3500
3501 case HCI_SCODATA_PKT:
3502 BT_DBG("%s SCO data packet", hdev->name);
3503 hci_scodata_packet(hdev, skb);
3504 break;
3505
3506 default:
3507 kfree_skb(skb);
3508 break;
3509 }
3510 }
1da177e4
LT		 3511}
3512
c347b765 3513static void hci_cmd_work(struct work_struct *work)
1da177e4 3514{
c347b765 3515 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 3516 struct sk_buff *skb;
3517
2104786b
AE		 3518 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
3519 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 3520
1da177e4 3521 /* Send queued commands */
5a08ecce
AE		 3522 if (atomic_read(&hdev->cmd_cnt)) {
3523 skb = skb_dequeue(&hdev->cmd_q);
3524 if (!skb)
3525 return;
3526
7585b97a 3527 kfree_skb(hdev->sent_cmd);
1da177e4 3528
70f23020
AE		 3529 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
3530 if (hdev->sent_cmd) {
1da177e4
LT		 3531 atomic_dec(&hdev->cmd_cnt);
3532 hci_send_frame(skb);
7bdb8a5c
SJ		 3533 if (test_bit(HCI_RESET, &hdev->flags))
3534 del_timer(&hdev->cmd_timer);
3535 else
3536 mod_timer(&hdev->cmd_timer,
5f246e89 3537 jiffies + HCI_CMD_TIMEOUT);
1da177e4
LT		 3538 } else {
3539 skb_queue_head(&hdev->cmd_q, skb);
c347b765 3540 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3541 }
3542 }
3543}
2519a1fc
AG		 3544
3545int hci_do_inquiry(struct hci_dev *hdev, u8 length)
3546{
3547 /* General inquiry access code (GIAC) */
3548 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3549 struct hci_cp_inquiry cp;
3550
3551 BT_DBG("%s", hdev->name);
3552
3553 if (test_bit(HCI_INQUIRY, &hdev->flags))
3554 return -EINPROGRESS;
3555
4663262c
JH		 3556 inquiry_cache_flush(hdev);
3557
2519a1fc
AG		 3558 memset(&cp, 0, sizeof(cp));
3559 memcpy(&cp.lap, lap, sizeof(cp.lap));
3560 cp.length = length;
3561
3562 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
3563}
023d5049
AG		 3564
3565int hci_cancel_inquiry(struct hci_dev *hdev)
3566{
3567 BT_DBG("%s", hdev->name);
3568
3569 if (!test_bit(HCI_INQUIRY, &hdev->flags))
7537e5c3 3570 return -EALREADY;
023d5049
AG		 3571
3572 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3573}
31f7956c
AG		 3574
3575u8 bdaddr_to_le(u8 bdaddr_type)
3576{
3577 switch (bdaddr_type) {
3578 case BDADDR_LE_PUBLIC:
3579 return ADDR_LE_DEV_PUBLIC;
3580
3581 default:
3582 /* Fallback to LE Random address type */
3583 return ADDR_LE_DEV_RANDOM;
3584 }
3585}
ubuntu-bionic-kernel mirror